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Welcome  participation  by  friends  of  survivability,  both  civil  and  military-related 

•  Join  the  association 

*  Let  us  know  about  your  interest 
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Topical  “Quick  Looks” 

o  Highly  focused  one  day  reviews  or  workshops 
o  Under  consideration 


Survivability  Means  Different  Things  to  Different  People 
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Testing 

Battle  damage  repair,  force  reconstitution 


A  Big  Question 
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become  more  active  since  much  associated  with  traditional 
survivability  is  seen  as  ‘old  hat’  and  not  relevant  to  the  challenges 
of  today  and  tomorrow 99 


State  of  Survivability  Community  and  Discipline 

Some  Observations 
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Three  Worthy  Near  Term  Goals 
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Resuscitate  the  increasingly  moribund  vulnerability  reduction  technology  base  -  breathe  some 
life  into  it!  Why  not  start  with  the  Civil-Military  Fire  and  Explosion  Mitigation  Project? 
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Member  National  Transportation  Safety  Board 


Remarks  To  The 
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October  21,  1997 
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Good  morning  . . . 

I  want  to  discuss  with  you  this  morning  the  subject  of  people;  how  they  are 
affected  by  the  system  as  well  as  their  influences  upon  the  system. 

Today’s  airplanes  are  subject  to  very  few  critical  failure  modes.  We  have 
nearly  eliminated  the  mechanical  causes  for  accidents.  This  is  traceable  to 
the  design  requirements  of  the  relevant  governmental  regulations  as  well  as 
the  specifications  of  operating  organizations  and  the  design  skills  of  manu¬ 
facturers.  We  have  come  a  long  way  in  the  last  80  years. 

But,  we  are  now  faced  with  what  I  believe  is  rapidly  becoming  the  dominant 
element  in  aviation  safety.  I  am  referring  to  people. 


They  are  affected: 

•  by  man/machine  interfaces  which  influence  mechanic,  controller 
and  pilot  induced  errors. 

•  by  relationships  between  designer  and  maintenance  users. 

•  by  relationships  between  and  among  regulators  and  regulated,  and; 

•  by  individual  responsibility  and  accountability 

During  the  past  two  years  in  the  civil  arena  we  have  had  an  unprecedented 
number  of  accidents  in  which  the  overwhelming  causes  appear  to  be  people 
centered.  Consider  some  recent  examples  of  problems  in  the  cockpit,  the 
tower  and  in  the  hanger. 

In  November, 1995  an  MD-80  was  nearly  lost  in  East  Granby,  Connecticut. 
Barely  two  months  later,  a  DC-9  was  nearly  lost  in  Houston  Texas.  Fortu¬ 
nately  there  were  no  serious  injuries  in  either  incident;  just  substantial 
damage  to  the  aircraft.  The  principle  causative  agents  in  both  these  incidents 
are  similar  -  people,  procedures  and  communications. 

I  am  further  alarmed  at  what  I  believe  is  a  trend  for  air  traffic  control  in¬ 
duced  pilot  error.  I  refer  to  controllers  who  issue  unreasonable,  unwise  or 
uninformed  instructions.  These  instructions  involve  maneuvering  aircraft  in 
ways  that  simply  should  not  be  undertaken. 

This  is  exemplified  by  a  recent  ATR  72  accident  in  Roselawn  Indiana;  and  an 
Embraer  120  in  Monroe  Michigan.  The  common  denominator  in  both  these 
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accidents  was  that  the  airplanes  were  operating  in  icing  conditions  for  an  ex¬ 
tended  period  at  slow  speeds.  The  pilots  of  these  aircraft  were  following  in¬ 
structions  from  ATC.  However,  ATC  was  not  aware  that  their  clearances  put 
the  airplanes  at  risk  and  the  pilots  did  not  inform  the  controllers  they  were  in 
icing.  Again  -  people,  procedures  and  communications. 

Between  1961  and  mid  1995  there  were  over  32  accidents  related  to  mainte¬ 
nance  error;  approximately  one  per  year.  Yet,  from  mid  1995  until  the  sum¬ 
mer  of  1996  we  had  5  accidents  directly  related  to  maintenance  error.  Some¬ 
thing  is  definitely  wrong.  I  suspect  -  people,  procedures  communications  and 
design. 

Finally,  in  1994  a  structural  survey  of  retired  transport  aircraft  was  done. 
This  involved  an  assessment  of  the  adequacy  of  structural  repairs  accom¬ 
plished  upon  them  during  their  working  lives.  The  results  were  alarming. 
Both  engineering  and  the  quality  of  accomplishment  of  the  repairs  was  dis¬ 
turbingly  inadequate.  Again  -  people,  procedures,  communications  and  design 
appear  to  be  underlying  culprits. 

The  common  denominator  among  all  these  accidents  is  that  the  human  in  the 
loop  fails  for  a  variety  of  reasons.  We  have  more  than  40  years  of  human  fac¬ 
tors  research  into  the  flight  deck,  a  little  less  than  ten  in  maintenance  and 
next  to  none  in  the  engineering  design  arena.  It’s  obvious  that  we  have  a  way 
to  go  before  we  understand  the  human  factors  issues.  People  related  acci¬ 
dents  continue  to  occur. 

The  elements  to  solving  much  of  the  people  problem  are  simple. 

Control  the  information  explosion  which  plagues  the  cockpit  and  the  hanger 
when  digital  airplanes  are  involved.  Aggressively  apply  existing,  proven 
human  factors  techniques  to  both;  but  particularly  to  the  long  neglected 
maintenance  and  design  disciplines. 

Bring  controllers  into  the  pilot  training  process  so  that  both  develop  a  better 
understanding  of  each  others  operating  environments. 

Design  for  maintenance. 

Maintainability  is  not  just  ergonomics  or  accessibility.  It  includes  the  man¬ 
agement  of  failure  to  keep  the  airplane  available  while  concurrently  keeping 
it  airworthy.  Engineering  needs  to  be  closer  to  maintenance,  both  at  the 
manufacturer  and  the  airline  to  accomplish  this  end.  Designers  and  main- 
tainers  must  communicate. 


14 


This  is  radical  thinking.  It  is  amazing  what  involvement  the  user  of  the 
product  with  the  designer  of  the  product  will  yield.  Original  designs  become 
more  appropriately  directed  toward; 

•  reducing  change  error  and  rework 

•  reducing  maintenance  related  error 

•  improving  equipment  reliability  and  hence  its’  availability  to  the 
schedule  and; 

•  reducing  maintenance  costs. 

This  means  maintenance  must  be  at  the  design  table  as  an  equal  to  the  de¬ 
mands  of  drag,  weight  and  producability.  But  in  turn  maintainers  must  con¬ 
cern  themselves  with  the  limitations  imposed  upon  designers. 

Engineering  designers  must  spend  time  at  the  maintenance  table.  Young  en¬ 
gineers,  as  a  part  of  their  training,  should  be  exposed  to  the  problems  and 
concerns  of  the  entire  maintenance  community  including  maintenance  engi¬ 
neering,  line  and  hanger  maintenance,  planning  and  task  performance.  This 
includes  a  healthy  infusion  of  practicality  to  temper  academic  correctness. 

The  relationships  between  government  and  industry  clearly  affect  people.  We 
are  all  a  part  of  one  global  aviation  family. 

Design,  operating  and  regulatory  issues  must  be  debated.  But,  put  principles 
before  personalities.  Let  the  debate  be  among  peers  not  adversaries.  We  must 
stop  bickering  and  sniping  at  each  other  -  industry,  operators  and  regulators. 
I  agree  heartily  with  the  principles  of  working  together. 

Finally  people  have  their  own  effect  upon  safety. 

Aviation  has  long  held  responsibility  and  accountability  to  be  core  values.  It 
is  an  industry  built  upon  trust.  Each  of  us  expects,  in  fact,  demands,  that 
every  discipline  do  his/her  job.  This  embraces  responsibility  and  accountabil¬ 
ity. 

However,  something  has  happened  within  our  operating  organizations.  I 
think  one  such  “something”  is  a  clear  change  in  the  employee  makeup  of  this 
industry. 

Employees  hired  since  the  mid  80’s  -  one  major  airline  calls  it  the  “Class  of 
1986,"  appear  to  come  into  the  industry  without  a  dedication  to  aviation. 
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They  only  accept  employment  because  it’s  a  job  with  better  benefits  than 
many  others.  Thus  we  see  today,  people  who  accomplish  their  work  blindly 
without  thinking  of  the  consequences  of  their  actions,  or  who  do  not  challenge 
the  system  if  they  believe  it  is  wrong.  They  are  part  of  a  culture  in  which  few, 
if  any,  feel  accountable  for  their  actions,  except  for  the  bottom  line  or  per¬ 
sonal  agendas.  The  consequences  are  disturbing. 

For  example. 

Some  of  you  may  believe  that  an  FAR  Part  145  repair  station  certificate  is  an 
automatic  index  of  quality  and  expertise.  This  is  not  always  the  case. 

This  became  painfully  clear  after  the  Everglades  accident.  We  found  that  up 
to  70%  of  the  employees  at  the  repair  station  associated  with  the  accident 
were  not  certified  technicians.  Many  had  minimal  training.  Under  these  cir¬ 
cumstances  an  extremely  good  quality  surveillance  system  would  be  assumed 
to  be  in  place.  But  it  wasn't. 

This  had  a  serious  negative  effect  upon  the  work  product  and  safety. 

It  is  the  true  people  problem. 

We  need,  many  believe,  a  return  to  a  culture  of  individual  responsibility  and 
accountability  for  behavior  within  our  system  if  we  hope  to  ever  get  a  handle 
on  all  our  safety  problems. 

In  conclusion,  safety  involves  people  —  their  procedures  communication,  de¬ 
signs  and  dedication.  I  believe  the  solutions  are  simple.  It  is  nothing  more 
than  a  reestablishment  of  cooperation  and  individual  responsibility. 

Thank  you... 
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ADPA/NSIA 


Hughes  Aircraft  Company 


VULNERABILITY  REDUCTION 
CRITICAL  FOR  TODAY  AND  TOMORROW 


THANK  YOU  FOR  THE  KIND  INTRODUCTION,  MR.  VICE,  ADMIRAL 
EVANS,  GENERAL  BURKE,  ADMIRAL  GORMLEY,  MR.  FRANCIS,  MR. 
MUTZELBURG,  DISTINGUISHED  GUESTS,  MEN  AND  WOMEN  OF  THE 

SURVIVABILITY  COMMUNITY,  LADIES  AND  GENTLEMEN - I  CAN 

NOT  TELL  YOU  HOW  HONORED  I  AM  TO  HAVE  BEEN  INVITED  TO 
SPEAK  TO  THIS  SYMPOSIUM. 

I  CONGRATULATE  YOU  ON  YOUR  CHOICE  OF  LOCATIONS  TO 
HOLD  THIS  SYMPOSIUM.  NAVY  POSTGRADUATE  SCHOOL 
MONTEREY,  CA  -—THE  PLACE  WHERE  SO  MANY  OF  US  HAVE 
GAINED  AN  APPRECIATION  AND  UNDERSTANDING  OF 
SURVIVABILITY  FROM  PROFESSOR  ROBERT  BALL,  AND  THE 
BIRTHPLACE  OF  THE  BIBLE  FOR  THIS  DISCIPLINE—  HIS  TEXT  BOOK 
THE  FUNDAMENTALS  OF  AIRCRAFT  COMBAT  SURVIVABILITY 
ANALYSIS  AND  DESIGN. 

YOU  HAVE  COME  A  LONG  WAY,  AND  THE  SUCCESSES  OF  YOUR 
PRODUCTS  IN  DESERT  STORM  HAVE  PROVEN  THE  VALUE  OF  THE 
EXPERTISE  THAT  YOU  HAVE  PROVIDED  TO  THE  AIRCRAFT  DESIGN 
COMMUNITY. 
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THE  DEFENSE  BUDGET  HAS  DECLINED  40%  IN  THE  PAST  EIGHT 
YEARS,  BUT  THE  PROCUREMENT  BUDGET  HAS  DECLINED  OVER 
SIXTY  PERCENT.  WE  ARE  BUYING  REPLACEMENT  HARDWARE, 
AIRCRAFT,  SHIPS,  TANKS,  TRUCKS  AT  A  RATE  THAT  WILL  NOT  COME 
CLOSE  TO  SUSTAINING  THE  SIZE  OF  THE  FORCE  STRUCTURE  THAT 
STUDY  AFTER  STUDY  SHOWS  OUR  NATION  NEEDS.  YOU  ALL  KNOW 
TOO  WELL  THIS  IS  A  TIME  OF  CHANGE  UNLIKE  ANY  OTHER. 

I’M  REMINDED  OF  THE  STORY  OF  THE  TRUCK  DRIVER  GOING 
DOWN  A  STEEP  WINDY  MOUNTAINSIDE  ROAD - 

LET  GO;  TRUST  ME.  IS  THERE  ANYONE  ELSE  UP  THERE  WHO  CAN 
HELP  ME? 

LIKE  MY  LITTLE  STORY,  THE  ENVIRONMENT  TODAY  IS  SAYING  TRUST 

ME,  LET  GO - YC  J  CANNOT  GO  ON  DOING  THINGS  THE  SAME 

WAY.  IN  MY  BRIEF  REMARKS  THIS  MORNING  I  HOPE  TO  LEAVE 
YOU  WITH  SIX  CHALLENGES: 

1 .  THE  SURVIVABILITY  WORLD  NEEDS  IMPROVED  MODELING 
AND  SIMULATION,  AND  YOU  NEED  TO  APPLY  IT  EARLIER 
AND  MORE  OFTEN  IN  THE  DESIGN  PROCESS. 
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2.  GREATER  UNDERSTANDING  NEEDS  TO  BE  ACHIEVED  OF 
YOUR  DISCIPLINE  THROUGHOUT  THE  DOD  COMMUNITY. 

3.  THE  SURVIVABILITY  COMMUNITY  NEEDS  TO  BE  BETTER 
INTEGRATED  WITH  THE  EW,  RELIABILITY  AND  SYSTEMS 
SAFETY  COMMUNITIES. 

4.  A  SYSTEMS  OF  SYSTEMS  PERSPECTIVE  NEEDS  TO  BE 
INTEGRATED  INTO  SURVIVABILITY  ANALYSIS 

5.  A  HIGH  LEVEL  DOD  CHAMPION  IS  NEEDED  TO  SUPPORT 
THE  INITIATIVES  OF  THE  SURVIVABILITY  COMMUNITY. 

BUT,  TO  MAKE  THE  CHANGES  AND  IMPROVEMENTS  I  HAVE  LISTED 
"YOU  CAN'T  JUST  KEEP  DOING  WHAT  YOU’VE  ALWAYS  BEEN 
DOING.  OR  YOU’LL  GET  WHAT  YOU’VE  ALWAYS  GOTTEN 

LET  ME  SHOW  YOU  A  COUPLE  OF  VIEWGRAPHS  THAT  MAKE  THE 
POINT  OF  HOW  WE  ARE  NOT  BUYING  AIRCRAFT  AT  A  RATE 
SUFFICIENT  TO  SUSTAIN  THE  FORCE  STRUCTURE. 
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THESE  NAVY  CHART  SHOWS  THAT  THE  NUMBER  OF  AIRCRAFT  IN 
THE  INVENTORY  HAS  DECLINED,  BUT  IS  PLANNED  TO  REMAIN 
RELATIVELY  STEADY.  THE  NEXT  CHART  DRAMATICALLY  SHOWS  THE 
DECLINE  IN  NUMBER  OF  AIRCRAFT  BOUGHT  PER  YEAR. 

THE  NEXT  CHART  SHOWS  HOW  LONG  TACTICAL  AIRCRAFT  ARE 
REMAINING  IN  THE  INVENTORY.  THE  MESSAGE  IS  LOUD  AND 
CLEAR—  WE  ARE  NOT  PROCURING  AIRCRAFT  AT  A  HIGH 
ENOUGH  RATE. 

THIS  HAS  SIGNIFICANT  IMPLICATIONS  FOR  THE  WORLD  OF 
SURVIVABILITY,  AND  MOST  DEFINITELY  VULNERABILITY  REDUCTION. 
WE  ARE  DEPENDING  ON  USING  OUR  AIRCRAFT  FOR  LONGER 
PERIODS  OF  TIME,  IN  PEACE  TIME  AND  IN  WAR.  AND  WE  EXPECT 
THEM  TO  SURVIVE  WHEN  USED  IN  ANGER. 

THE  DEBATES  RAGE  OVER  THE  RIGHT  BALANCE  OF  CRUISE 
MISSILES,  STAND  OFF  WEAPONS,  STEALTH  AIRCRAFT,  AND  IN  THE 
FUTURE  UNINHABITED  COMBAT  AIR  VEHICLES. 

BUT  IN  EACH  OF  THESE  VEHICLES  THE  NEED  FOR  SUSCEPTABILITY 
AND  VULNERABILITY  REDUCTIONS  LOOM  HIGH,  AND  THE  COST 
OF  EACH  OF  THESE  SYSTEMS  DEMANDS  THAT  SURVIVABILITY  BE  AN 
UPFRONT  DESIGN  CONSIDERATION. 
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ACQUISITION  REFORM  IS  MOVING  VERY  WELL,  AND  UNDER  DR. 
GANSLER  I  FULLY  EXPECT  THE  RATE  OF  POSITIVE  CHANGE  TO 
CONTINUE.  COST  AS  AN  INDEPENDENT  VARIABLE  IS  THE 
BENCHMARK  THAT  MUST  BE  USED  TO  DESIGN  AND  DEVELOP  OUR 
SYSTEMS  FOR  THE  FUTURE.  I  REALIZE  THAT  THE  UNDERSTANDING 
AND  SUCCESSFUL  USE  OF  CAIV  IS  SPOTTY,  BUT  I  CAN  ASSURE  YOU 
THAT  DOD’S  COMMITMENT  TO  MAKE  THIS  SUCCEED  IS  STRONG— 
AND  SURVIVABILITY  MUST  BE  PART  OF  THE  COST  BENEFIT  \NALYSIS 
TRADES. 

OTHER  ACQUISITION  REFORM  INITIATIVES  INCLUDE  GOING  TO 
PERFORMANCE  SPECS,  THE  ABSENCE  OF  MIL  SPECS,  AND  THE 
INCREASED  USE  OF  COMMERCIAL  CONTENT  IN  ALL  OF  OUR 
SYSTEMS. 

IF  YOU  ARE  NOT  WORRIED  —  YOU  BETTER  WAKE  UP.  WHEN  THE 
COST  TRADES  ARE  MADE,  AND  THE  COMMERCIAL  CONTENT 
APPLIED,  ARE  YOU  CONFIDENT  THAT  THE  SURVIVABILITY 
DISCIPLINE  WILL  HAVE  A  SEAT  AT  THE  DECISION  TABLE? 

WHEN  THE  TEST  PLAN  IS  CREATED  AND  THE  LIVE  FIRE  TEST 
PROGRAM  DEVELOPED,  WILL  IT  BE  AFFORDABLE,  OR  WILL  IT 
BREAK  THE  AFFORDABILITY  BANK  OF  THE  PROGRAM? 


THOSE  QUESTIONS  SHOULD  CONVINCE  YOU  THAT  THE  TIME  IS 
NOW  TO  FIND  MORE  AFFORDABLE  WAYS  TO  KEEP  SURVIVABILITY 
AT  THE  FRONT  OF  THE  DECISION  PROCESS.  IT  IS  FAR  TOO  LATE 
WHEN  THE  SYSTEM  FAILS  A  LIVE  FIRE  DEMO  OR  A  SURVIVABILITY 
TEST  TO  MAKING  THE  NEEDED  DESIGN  CHANGES. 

WE  NEED  A  BETTER  APPROACH  TO  MODELING  AND  SIMULATION. 

THE  JTCG  (AS)  HAS  BEEN  VALIANTLY  WORKING  FOR  THE  PAST  10 
YEARS,  IN  WHICH  I'VE  BEEN  SOMEWHAT  INVOLVED,  IN  THE  VV&A 
OF  A  STANDARD  SET  OF  SURVIVE  BILITY  MODELS.  THE  GOOD 
NEWS  IS  THAT  THE  OSD  FUNDING  FOR  THIS  VITAL  EFFORT  APPEARS 
TO  BE  GETTING  SUPPORT,  ALBEIT  ONLY  AT  THE  RELATIVELY  LOW 
LEVEL  OF  ABOUT  $  7  MILLION  A  YEAR. 

SIX  YEARS  AGO  I  BECAME  INVOLVED  IN  TRYING  TO  FIND  A  WAY 
TO  CREATE  A  PANEL  OF  OUR  NATION'S  FOREMOST  SURVIVABILITY 
FXPERTS  TO  REVIEW  EVERY  MAJOR  PROGRAM’S  PROPOSED  Mo.S 
PLAN  FOR  SURVIVABILITY  ANALYSIS.  THE  EXPECTATION  WAS  THAT 
A  CONSISTENT  SET  OF  MODELS  WOULD  BE  UTILIZED,  LESSONS 
LEARNED  WOULD  BE  SHARED  FROM  PROGRAM  TO  PROGRAM, 
THE  FIDELITY  AND  UTILITY  OF  MODELS  WOULD  IMPROVE,  THE 
DOLLARS  SPENT  ON  M&S  IN  BOTH  INDUSTRY  AND  THE 
GOVERNMENT  WOULD  BE  MORE  FOCUSED  AND  THEREBY  MORE 
EFFICIENTLY  USED,  AND  LASTLY,  AND  MOST  IMPORTANTLY,  WE 
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WOULD  AVOID  THE  COSTLY  LATE  IN  THE  GAME  DISPUTES  OVER 
THE  SELECTION  OF  THE  MODELS  USED  OR  THE  VALIDITY  OF  THE 
RESULTS  ACHIEVED. 

WHEN  I  WAS  ASKED  TO  SPEAK  AT  THIS  SYMPOSIUM,  I  INQUIRED  AS 
TO  THE  STATUS  OF  THE  EFFORT  TO  CHARTER  A  BODY  OF  "EXPERTS 
IN  SURVIVABILITY”  TO  VALIDATE  THE  M&S  PLANS  FOR  THE 
SURVIVABILITY  ANALYSIS  OF  AIRCRAFT  SYSTEMS.  I  WAS  TOLD  THAT 
IT  IS  BASICALLY  JUST  WHERE  IT  WAS  WHEN  I  LEFT  DOD,  OR  WHEN  I 
DEPARTED  THE  JACG  IN  MAR  OF  95. 

CHANGE  IS  OFTEN  DIFFICULT  TO  BRING  ABOUT,  BUT  I  HAVE  NEVER 
SEEN  ANYTHING  THAT  SEEMED  SO  LOGICAL  TO  DO,  BE  SO 
DIFFICULT  TO  BRING  ABOUT. 

UNLESS  THIS  COMMUNITY  FINDS  A  WAY  TO  GAIN  SERVICE  AND 
OSD  ACCEPTANCL,  AND  YES  APPROVAL,  OF  THE  M&S  PLANS 
DEVELOPED  FOR  SYSTEMS  BEFORE  THE  EFFORTS  ARE  EXPENDED 
RUNNING  THE  SCENARIOS  AND  COMPLETING  THE  ANALYSIS,  WE 
WILL  CONTINUE  TO  INVITE  COSTLY  DISPUTES,  THAT  DELAY 
PROGRAMS,  ARGUING  OVER  THE  SELECTION  OF  MODELS  AND 
SCENARIOS  IN  ASSESSING  A  SYSTEM'S  SURVIVABILITY. 
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I’M  REMINDED  OF  THE  STORY  OF  THE  THREE  DOD  COMPTROLLERS 
WHO  DIED,  AND  TO  ST.  PETER’S  AMAZEMENT  WENT  TO  HEAVEN 

AND  WERE  STANDING  OUTSIDE  THE  PEARLY  GATES. - 

“THEY’RE  GONE”  ALL  THREE  ARE  GONE?  “NO,  THEY  HAVE 
TAKEN  THE  PEARLY  GATES" 

THERE’S  A  MESSAGE  IN  THAT  STORY,  BECAUSE  THE 
COMPTROLLERS  HAVE  NO  CHOICE  BUT  TO  SPREAD  THE  LIMITED 
DEFENSE  DOLLARS  TO  COVER  ALL  NEEDS.  AND  THAT  MEANS  NOT 
HAVING  ENOUGH  IN  MOST  PROGRAMS  TO  DO  ALL  THAT  IS 
NEEDED  TO  BE  DONE. 

AND  THIS  GETS  ME  TO  MY  SECOND  POINT.  SURVIVABILITY  IS  A 
DISCIPLINE  THAT  IS  NOT  WELL  UNDERSTOOD.  YES,  PEOPLE 
UNDERSTAND  RADAR  SIGNATURE  AND  THE  ADVANTAGES  OF 
STEALTH,  AND  THE  NEEDS  FOR  ELECTRONIC  COUNTERMEASURES. 
BUT  VERY  FEW  PEOPLE  APPRECIATE,  NOR  DO  THE  REQUIREMENT 
SETTERS  EVEN  SET  REQUIREMENTS  FOR  VULNERABILITY. 

THE  LIVE  FIRE  TEST  LAW  WAS  NEEDED  WHEN  IT  WAS  ENACTED. 
INADEQUATE  ATTENTION  WAS  BEING  PAID  TO  VULNERABILITY  IN 
THE  DESIGN  OF  OUR  SYSTEMS.  BUT  I  DO  BELIEVE  THAT  DOD  HAS 
RECEIVED  THE  MESSAGE,  AND  VULNERABILITY  IS  A  STRONG 
DESIGN  CONSIDERATION  IN  ALL  OF  OUR  NEW  SYSTEMS. 
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BUT  IT  IS  TIME  FOR  A  MAJOR  REASSESSMENT  OF  HOW  THE  LIVE 
FIRE  TEST  LAW  IS  BEING  APPLIED.  WE  SIMPLY  CANNOT  AFFORD  TO 
DO  FULL  SCALE  LIVE  FIRE  TESTS  ON  ALL  PLATFORMS.  THERE  ARE 
EXAMPLES  OF  SUCCESSFUL  APPLICATION  OF  THE  LAW,  SUCH  AS 
THE  V- 22.  WHERE  SELECTED  MAJOR  COMPONENT  TESTS  ARE 
BEING  CONDUCTED,  AND  AN  ENTIRE  VEHICLE  WILL  NOT  BE  USED 
FOR  THE  LIVE  FIRE  TEST. 

HOWEVER,  THE  V-22  IS  NOT  THE  GENERAL  RULE.  WE  NEED  A 
BETTER  SET  OF  MODELS  FOR  VULNERABILITY  ANALYSIS.  ONE  CAN 
NEVER  USE  M&S  FORD  THE  ENTIRE  VULNERABILITY  ANALYSIS,  BUT 
SMART  M&S  CAN  BE  USED  IN  CONJUNCTION  WITH  COMPONENT 
AND  COUPON  TESTS  TO  GREATLY  REDUCE  THE  COST  OF  A  LIVE 
FIRE  TEST  PROGRAM,  WITH  LITTLE  RISK  IN  NOT  CORRECTLY 
UNDERSTANDING  THE  VULNERABILITY  OF  THE  SYSTEM. 

BUT  TO  BRING  ABOUT  ANY  CHANGE,  YOU  NEED  TO  HAVE 
UNDERSTANDING  AMONG  THE  DECISION  MAKERS,  OR  THEY  WILL 
BE  UNWILLING  TO  GO  FORWARD  ASKING  TO  CHANGE  A  LAW  OR 
SEEK  A  WAIVER.  SO  I  REITERATE  THE  POINT  ON  THE  NEED  TO  GET 
INCREASED  UNDERSTANDING,  ESPECIALLY  OF  THE  VULNERABILITY 
PART  OF  SURVIVABILITY,  AMONG  THE  DECISION  MAKERS  IN  DOD. 
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THE  THIRD  POINT: 


INTEGRATION  OF  SURVIVABILITY  WITH  THE  EW  COMMUNITY 
IS  A  MUST.  WE  HAVE  BEEN  TALKING  ABOUT  THIS  FOR  YEARS,  BUT 
THE  NEED  IS  GREATER  NOW  THAN  EVER  BEFORE. 

SIGNATURE  REDUCTION  HAS  TAKEN  ENORMOUS  STRIDES  AND  HAS 
BEEN  A  BIG  BOOST  FOR  SURVIVABILITY.  BUT  THIS  HAS 
HIGHLIGHTED  THE  NEED  TO  LOOK  AT  THE  TOTAL  AIRCRAFT 
SOLUTIO.  ;  TO  SURVIVAL. 

THIS  CHART  SHOWS  WHAT  I  CALL  THE  SURVIVABILITY  ANALYSIS 
FUNNEL.  FROM  MISSION  PLANNING,  SUPPORT  ASSETS,  THE 
INHERENT  SIGNATURE  OF  THE  VEHICLE,  THE  SMART  USE  OF  RWR 
AND  FLYING  THE  ROUTE,  THE  APPLICATION  OF  ECM,  TOWED 
DEVICES  AND  EXPENDABLES,  AND  THEN  IF  HIT,  THE  VULNERABILITY 
OF  THE  PLATFORM. 

YOU  HAVE  ALL  SEEN  VERSIONS  OF  THIS  BEFORE.  BUT  IT  THIS 
COMMUNITY’S  RESPONSIBILITY  TO  HELP  THE  DECISION  MAKER 
AND  THE  SYSTEM  DESIGNER  IN  MAKING  THE  RIGHT  TRADES. 


IN  FACT  IT  REQUIRES  MORE  THAN  JUST  INTEGRATING  THE  EW  AND 
SURVIVABILITY  COMMUNITIES.  THE  RELIABILITY  COMMUNITY  AS 
WELL  AS  THE  SYSTEM  SAFETY  COMMUNITY  MUST  BE  INTEGRATED 
INTO  YOUR  DESIGN  PROCESS.  I  TRUST  THAT  THE  INCREASED  USE 
OF  IPTS  THROUGHOUT  THE  INDUSTRY  IS  MAKING  THIS  EASIER  THAN 
EVER  BEFORE. 

THE  DESIGN  DECISIONS  MADE  TO  IMPROVE  RELIABILITY  VERY 
OFTEN  SIGNIFICANTLY  IMPROVE  SURVIVABILITY.  TAKE  THE 
RECONFIGURABLE  CENTRAL  PROCESSOR  THAT  MY  COMPANY 
HUGHES  HAS  DESIGNED  FOR  THE  F-22. 

OR  THE  DIGITAL  FLIGHT  CONTROL  SYSTEM  AND  ITS 
RECONFIGURABLE  CAPABILITIES  THAT  ARE  RESIDENT  ON  THE 
F/A-18  TODAY  AND  WERE  SUCCESSFULLY  DEMONSTRATED 
DURING  DESERT  STORM. 

THE  ROBUST  ELECTRONIC  DESIGNS  WE  ARE  LOOKING  AT  FOR 
FUTURE  SYSTEMS  HAVE  GRACEFUL  DEGRADATION  BUILT  IN.  FROM 
A  VULNERABILITY  STAND  POINT  THAT  MEANS  BEING  ABLE  TO 
SUSTAIN  DAMAGE  BUT  CONTINUE  TO  OPERATE  IN  ORDER  TO 
SUCCESSFULLY  COMPLETE  THE  MISSION. 
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SYSTEM  REDUNDANCY,  GRACEFUL  DEGRADATION  ARE  BEING 
DRIVEN  BY  THE  NEED  TO  IMPROVE  RELIABILITY  AND  DECREASE 
LIFE  CYCLE  COST.  TO  DO  THIS  SMART  REQUIRES  CLOSE 
INTEGRATION  OF  THE  SURVIVABILITY,  RELIABILITY,  SYSTEMS  SAFETY, 
FLIGHT  CONTROL,  PROPULSION,  FUELS,  AND  EW  COMMUNITIES. 

UP  UNTIL  THIS  POINT  WE  HAVE  SPOKEN  ABOUT  THE  SURVIVABILITY 
AND  VULNERABILITY  ENHANCEMENT  OF  A  SINGLE  PLATFORM.  WE 
NEED  TO  EXTEND  OUR  VIEW  BEYOND  THE  INDIVIDUAL  PLATFORM 
AND  LOOK  AT  SURVIVABILITY  FROM  A  SYSTEMS  OF  SYSTEMS 
PERSPECTIVE. 


WE  DO  NOT  NEED  THE  FULL  CAPABILITY,  INCLUDING  THE 
ABSOLUTE  END  ALL  SURVIVABILITY,  IN  EVERY  PLATFORM.  OUR 
NATION  SIMPLY  CANNOT  AFFORD  THE  PRICE,  UNLESS  WE  WANT 
AN  AVIATION  CAPABILITY  WITH  VERY  FEW  AIRCRAFT. 

TODAY  A  SIGNIFICANT  EFFORT  IS  CORRECTLY  BEING  APPLIED 
INTO  MAKING  OUR  WEAPONS  SURVIVABLE.  THE  SAME  DESIGN 
PROCESS  THAT  IS  USED  FOR  MANNED  PLATFORMS  APPLIES. 
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COST  TRADES  NEED  TO  BE  MADE,  AND  THIS  COMMUNITY  HAS  THE 
TOOLS  THAT  NEED  TO  BE  INCORPORATED  INTO  THE  SYSTEMS  OF 
SYSTEMS  LOOKS  THAT  SHOULD  BE  USED  IN  CONJUNCTION  WITH 
COST  AS  AN  INDEPENDENT  VARIABLE  FOR  EACH  SYSTEM  WE 
PROCURE. 

LIVING  WITHIN  THE  PREDICTED  BUDGETS  OF  THE  FUTURE,  AND 
SUSTAINING  A  FORCE  STRUCTURE  OF  THE  SIZE  OUR  NATION 
CONTINUES  TO  REAFFIRM  ITS  NEED  FOR,  REQUIRES  THAT  THE 
SYSTEM  OF  SYSTEM  PERSPECTIVE  BE  APPLIED  TO  DETERMINE  THE 
CAPABILITIES  NEEDED  IN  EACH  OF  OUR  WEAPON  SYSTEMS. 

THE  LAST  POINT  I’D  LIKE  TO  LEAVE  YOU  WITH  IS  THE  ABSOLUTE 

NEED  TO  FIND  A  TRUE  CHAMPION.  AT  A  VERY  SENIOR  LEVEL  FOR 
SURVIVABILITY  IN  POD. 

THE  CHANGES  THAT  DOD  IS  UNDERGOING  DEMAND  THAT  THE 
VERY  IMPORTANT  DISCIPLINE  OF  SURVIVABILITY  HAVE  A 
SPOKESPERSON  WHO  HAS  THE  UNDERSTANDING  AND  WILL  MAKE 
THE  COMMITMENT  TO  SUPPORT  THE  SMART  THINGS  THAT  NEED  TO 
BE  DONE  TO  KEEP  SURVIVABILITY  AT  THE  HEAD  TABLE  AS  AN 
AFFORDABLE  AND  VITAL  DISCIPLINE  FOR  THE  DESIGN  OF  ALL  OF 
OUR  AIR  SYSTEMS. 
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IN  CONCLUSION,  I  TALKED  ABOUT  SIX  CHALLENGES  AND  NEEDS. 
OR  ACTIONS  THAT  NEED  TO  BE  TAKEN: 

1.  YOU  NEED  MAJOR  IMPROVEMENTS  TO  THE  ENTIRE 
APPROACH  FOR  M&S  FOR  SURVIVABILITY 

2.  YOU  NEED  TO  GET  MUCH  GREATER  UNDERSTANDING  OF 
YOUR  DISCIPLINE  TO  ALL  OF  THE  DECISION  MAKERS  IN 
THE  ACQUISITION  PROCESS— IN  BOTH  GOVERNMENT 
AND  INDUSTRY 

3.  YOU  NEED  TO  INTEGRATE  THE  EW  COMMUNITY  WITH 
SURVIVABILITY,  AS  WELL  \S  RELIABILITY  AND  SYSTEMS 
SAFETY. 

4.  YOU  NEED  TO  ADD  A  SYSTEMS  OF  SYSTEMS  PERSPECTIVE 
TO  SURVIVABILITY  ANALYSIS 

5.  AND  LASTLY,  YOU  NEED  A  HIGH  LEVEL  SURVIVABILITY 
CHAMPION  WITHIN  THE  DOD. 

THANK  YOU  FOR  YOUR  ATTENTION  AND  FOR  GIVING  ME  THE 
OPPORTUNITY  TO  TALK  TO  YOU  THIS  MORNING.  I’D  BE  PLEASED  TO 
ANSWER  ANY  QUESTIONS. 
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Enhance  Survivability 


A  History  of  the  Survivability  Design  of  Military  Aircraft 


Robert  E.  Ball1 
Naval  Postgraduate  School 
Monterey,  California 

DaleB.  Atkinson2 
Springfield,  Virginia 


Abstract 

In  simple  words,  survivability  in  combat  is  achieved  by 
not  getting  hit  by  the  enemy’s  weapons  or  withstanding 
the  effects  of  any  hits  suffered.  The  likelihood  an  aircraft 
gets  hit  while  on  a  mission  is  referred  to  as  the  aircraft’s 
susceptibility,  and  the  likelihood  the  aircraft  is  killed  by 
the  hit  is  referred  to  as  the  aircraft’s  vulnerability. 
Reduction  of  aircraft  susceptibility  is  achieved  by  (1) 
the  selection  of  the  appropriate  weapons,  tactics,  threat 
suppression,  and  support  jamming  for  the  mission,  (2) 
reducing  the  aircraft’s  signatures,  and  (3)  incorporating 
on-board  threat  warning  equipment  and  countermeasures 
in  the  form  of  electromagnetic  jammers  and 
expendables.  Reduction  of  aircraft  vulnerability  is 
achieved  by  (1)  the  use  of  redundant  flight  critical 
components,  adequately  separated  so  that  a  single  hit 
does  not  kill  them  all,  (2)  properly  locating  the  critical 
components  to  reduce  vulnerability,  (3)  designing  the 
critical  components,  or  adding  equipment,  to  suppress 
the  effects  of  any  hits,  and  (4)  shielding  those 
components  that  cannot  be  protected  otherwise.  All  of 
these  concepts  for  enhancing  survivability  impact  the 
design  of  the  aircraft.  The  importance  of  survivability  in 
the  design  of  aircraft  has  varied  throughout  the  20th 
century  from  a  total  neglect  to  the  highest  priority.  This 
paper  presents  the  evolution  of  the  survivability  derign 
of  aircraft  from  the  beginning  of  World  War  II  to  ihe 
present  time. 

Introduction 

Aircraft  combat  survivability  is  defined  in  [1]  as 
“the  capability  of  an  aircraft  to  avoid  and/or  withstand  a 
man-made  hostile  environment.”  The  inability  of  an 
aircraft  to  avoid  the  radars,  guns,  ballistic  projectiles, 


guided  missiles,  exploding  warheads,  and  other  elements 
that  make  up  the  hostile  air  defense  environment  is 
referred  to  as  the  susceptibility  of  the  aircraft.  An 
aircraft’s  susceptibility  can  be  measured  by  the 
probability  the  aircraft  is  hit  while  on  its  mission,  PH. 
7>is,  slow,  low-flying  aircraft  th?‘  are  easily  detected, 
tracked,  engaged  and  eventually  hit  with  one  or  more 
damage-causing  mechanisms  associated  with  the 
enemy’s  weapons  are  very  susceptible.  Fast,  high¬ 
flying  aircraft  that  are  difficult  to  detect,  difficult  to 
trade  if  detected,  difficult  to  engage  if  tracked,  and 
difficult  to  hit  if  engaged  are  relatively  unsusceptible. 

The  inability  of  an  aircraft  to  withstand  any  hits  by 
the  hostile  environment  is  referred  to  as  the 
vulnerability  of  the  aircraft.  An  aircraft’s  vulnerability 
can  be  measured  by  the  conditional  probability  the 
aircraft  is  killed  given  a  hit,  P^.  Aircraft  that  have  one 
engine,  no  fuel  system  fire/explosion  protection, 
redundant  but  collocated  hydraulic  systems  with 
flammable  hydraulic  fluid,  and  one  unprotected  pilot  are 
very  vulnerable.  Aircraft  with  two  widely  separated 
engines,  protected  fuel  systems,  redundant  and  separated 
hydraulic  systems  with  non-flammable  hydraulic  fluid, 
and  shielding  around  the  pilot  are  relatively 
invulnerable. 

The  survivability  of  an  aircraft  can  be  measured  by 
the  probability  of  survival,  Ps,  which  depends  upon  the 
aircraft’s  susceptibility  and  vulnerability  according  to 
the  equation 

Ps  =  1  -  PHP|cm 

Thus,  survivability  is  enhanced  when  susceptibility  and 
vulnerability  are  reduced. 
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Another  aspect  of  survivability  is  the  ability  to 
rapidly  repair  any  damage  sustained  in  battle.  If  this 
damage  cannot  be  quickly  repaired,  the  aircraft  may  not 
be  returned  to  action  in  time  to  contribute  to  the  final 
outcome;  and  in  essence  it  becomes  a  ‘killed’  aircraft. 
Thus,  the  design  of  an  aircraft  to  allow  the  rapid  repair 
of  battle  damage  is  an  indirect  contributor  to 
survivability,  not  because  it  increases  the  survivability 
of  the  individual  aircraft,  but  because  it  enhances  force 
reconstitution  and,  consequently,  force  survivability. 


Survivability  Enhancement  Features  and  Concepts 

Any  particular  characteristic  of  the  aircraft  specific 
piece  of  equipment,  design  technique,  armament,  or 
tactic  that  reduces  either  the  susceptibility  or  the 
vulnerability  of  the  aircraft  has  the  potential  for 
increasing  survivability  and  is  referred  to  as  a 
survivability  enhancement  feature.  [1]  Table  1  contains 
a  list  of  some  of  the  survivability  enhancement  features 
that  have  been  used  on  aircraft.  Each  of  the  survivability 
enhancement  features  listed  in  Table  1  can  be  grouped 
under  one  of  the  six  concepts  for  reducing  susceptibility 
or  six  concepts  for  reducing  vulnerability.  Table  2 
contains  the  twelve  survivability  enhancements 
concepts  with  an  example  of  a  particular  survivability 
enhancement  feature  under  each  concept. 


Survivability  and  Aircraft  Design 

Combat  survivability  as  a  formal  design  discipline 
for  aircraft  is  a  relatively  new  concept.  Although  many 
aircraft  of  the  past  were  designed  with  survivability  in 
mind,  oarticularly  during  WW  II,  until  recently  there 
was  no  systems  approach”  to  the  survivability  design 
solution.  Guns  and  missiles  wu,  added  for  self-defense, 
fuel  systems  were  protected  from  fire  and  explosions, 
better  tactics  were  developed,  electronic  countermeasures 
(ECM)  were  used,  more  realistic  training  was  provided, 
structures  were  made  more  resistant  to  enemy  fire,  and 
camouflage  paint  schemes  were  applied.  However,  all  of 
this  was  done  within  the  context  of  the  individual 
aircraft  design  disciplines,  and  no  attempt  was  made  to 
justify  the  inclusion  of  any  of  these  survivability 
enhancement  features  in  the  design  other  than  to  note 
that  aircraft  that  had  them  lived  longer  in  combat  were 
“better”  or  more  effective  than  those  that  didn’t  The 
hard  lessons  learned  in  combat  were  fed  back  into  the 
design  of  new  and  improved  versions. 


There  were  two  reasons  for  this  historical  lack  of  a 
systems  approach  to  survivability  and  a  quantification 
of  the  “payoffs”  or  increase  in  operational  effectiveness 
and  the  costs  associated  with  a  more  survivable  design. 
First,  the  systems  approach  to  aircraft  design  had  not 
been  fully  developed.  Second,  there  were  no  specific 
design  requirements  imposed  by  the  military  Services 
on  the  various  measures  of  survivability,  such  as  the 
maximum  allowable  or  vulnerable  area  (that  area 
on  the  aircraft  which  if  hit  would  cause  an  aircraft  kill) 
or  radar  cross  section,  because  survivability  was  not 
considered  to  be  a  formal  attribute  of  a  military  aircraft. 
Consequently,  there  was  no  apparent  need  for  a  formal 
discipline. 

The  importance  of  survivability  in  the  design  of 
military  aircraft  increased  dramatically  in  the  middle 
IS'SO’s  when  many  aircraft,  not  specifically  designed  to 
be  survivable,  were  shot  down  in  Southeast  Asia 
(SEA).  In  the  years  from  1963  to  1973,  the  U.  S. 
military  Services  lost  approximately  5,000  aircraft  to 
enemy  fire  in  SEA.  The  losses  were  nearly  equally 
divided  between  fixed-wing  aircraft  and  helicopters. 
Perhaps  the  first  publication  to  bring  attention  to  the 
technology  that  could  make  aircraft  more  survivable  was 
the  paper  “Design  of  Fighter  Aircraft  for  Combat 
Survivability,”  published  in  1969.  [2] 

Because  of  the  U.S.  military’s  experience  over  the 
jast  five  decades  with  aircraft  that  were  not  specifically 
designed  to  survive  in  combat,  survivability  has  become 
a  “critical  system  characteristic”  that  has  emerged  as  a 
distinct  and  important  design  discipline.  A  viable,  cost- 
effective  technology  exists  for  reducing  susceptibility 
and  vulnerability,  a  methodology  exists  for  assessing 
survivability,  education  in  survivability  is  avr  able, 
testing  for  survivability  is  mandated,  top  level 
survivability  design  guidance  is  prescribed,  ana 
quantified  requirements  on  the  susceptibility  aid 
vulnerability  of  aircraft  are  now  routinely  specified. 
Table  3  shows  the  history  of  the  requirements  for 
survivability  since  1950.  Much  of  the  credit  for  the 
increased  emphasis  on  the  survivability  of  aircraft  goes 
to  the  Joint  Technical  Coordinating  Group  on  Aircraft 
Survivability  (JTCG/AS),  which  was  established  in 
1971  with  a  goal  to  develop  survivability  as  a  design 
discipline.  Credit  also  goes  to  the  Department  of 
Defense  survivability  organizations,  the  survivability 
engineers  in  the  aircraft  industry,  arc!  those  military 
program  managers  that  made  sure  their  aircraft  were 
designed  to  be  survivable. 

This  paper  will  review  the  evolution  of  the 
survivability  design  of  aircraft  from  the  beginning  of 


World  War  II  to  the  present  time.  The  review  will 
examine  both  susceptibility  and  vulnerability  reduction. 
However,  because  of  the  classified  nature  of  much  of  the 
technology  for  susceptibility  reduction,  the  paper  will 
emphasize  vulnerability  reduction. 


Susceptibility  Reduction 

World  War  n 

Susceptibility  reduction  has  been  a  goal  of  the 
tactician  from  the  beginning.  The  tactics,  weapons 
selection,  mission  planning  systems,  force  packaging, 
and  threat  suppression  used  by  the  military  balance  the 
requirement  to  accomplish  the  mission  with  the 
expected  aircraft  losses.  This  is  known  as  managing 
attrition.  Managing  attnuon  by  avoiding  the  enemy’s 
air  defense  has  always  been  a  high  priority  goal.  During 
WW II,  hundreds  of  B~17s  flew  at  high  altitude  in  box 
formations,  escorted  by  P-47  and  P-51  fighters  looking 
for  the  enemy  fighters.  The  bombers  were  located  far 
enough  apart  -  so  that  an  exploding  shell  from  an  anti¬ 
aircraft  artillery  piece  (AAA),  known  as  flak,  would  not 
damage  or  kill  more  than  one  aircraft  -  but  close 
enough  together  so  that  the  enemy  fighters  could  not 
easily  maneuver  between  them.  They  were  loaded  down 
with  twin-50  cal  machine  guns  mounted  in  electrically 
driven  turrets,  and  eight  of  the  ten  crew  members  were 
firing  guns  at  the  enemy  fighters.  The  weight  of  the 
guns  and  ammunition  was  approximately  twice  the 
weight  of  the  bombs  carried.  [3]  The  B-17s  flew  during 
the  day,  which  made  them  more  susceptible,  because 
they  used  the  Norden  bombsight  which  required  the 
bombardier  to  see  the  target.  The  British  flew  their 
Lancaster  and  Halifax  bombers ;  night  because  they  had 
a  better  chance  of  avoiding  the  fighters  and  the  flak.  As 
a  result,  they  were  less  susceptible  and  hence  more 
survivable  at  night.  However,  it  also  was  more  difficult 
to  destroy  a  particular  factory  or  bridge  when  bombing 
at  night.  The  development  of  electronic  countermeasures 
to  the  early  radar  systems  was  a  high  priority  item,  and 
radar-reflecting  chaff  or  “window”  was  used  extensively, 
after  some  early  hesitation  because  of  the  fear  the  enemy 
might  use  it  against  the  allied  radars.  References  [4]  and 
[5]  present  a  detailed  history  of  the  use  of  electronic 
countermeasures  in  WW  II. 

The  Southeast  Asia  Conflict 

Many  of  the  tactics  used  to  avoid  the  hostile 
environment  in  SEA  in  the  decade  from  1963-72  were 
essentially  the  same  as  those  used  in  WW  II,  such  as 


formations  of  bombers  escorted  by  fighters.  However, 
the  bombers,  such  as  the  B-52,  F-105,  F-4,  A-4,  A- 
6,  and  A-7,  had  little  or  no  self-defense  capability. 
They  relied  totally  on  the  fighter  escorts,  such  as  the  F- 
4,  to  keep  the  enemy  fighters  away.  The  surface-to-air 
guided  missile  (SAM)  emerged  as  a  major  threat  to 
contend  with,  and  on-board  threat  warning  receivers  and 
electronic  jamming  equipment,  and  the  support 
jamming  provided  by  aircraft  such  as  the  EA-6,  became 
major  contributors  to  survivability.  Specially  modified 
aircraft  were  used  in  the  suppression  of  enemy  air 
defense  (SEAD)  role  to  seek  out  and  destroy  the  enemy 
SAM  launch  sites.  Mission  profiles  were  often  used 
that  kept  the  aircraft  out  of  the  high  altitude  envelopes 
of  the  SAMs  but  put  them  within  range  of  ground- 
based  small  arms  and  AAA  fire.  Reference  [5]  presents  a 
brief  history  of  the  use  of  electronic  warfare  in  the  SEA 
conflict. 

The  Recent  Past 

As  a  result  of  the  large  number  of  tactical  and 
strategic  aircraft  lost  in  the  SEA  conflict,  a  major 
revolution  in  the  design  priorities  of  military  aircraft 
began  in  the  late  1970’s  when  the  first  stealth  aircraft 
programs  were  started  in  an  attempt  to  reduce  aircraft 
susceptibility  without  the  use  of  large  numbers  of 
supporting  aircraft.  These  so-called  stealthy  aircraft, 
such  as  the  F- 11 7,  A-12,  F-22,  RAH-66,  and  the  B- 
2,  look  different.  Their  engine  inlets  and  exhausts  are 
modified,  their  wing  sweep  angles  are  high,  some  of 
them  lack  the  traditional  vertical  tail,  and  they  do  not 
have  the  many  bumps  and  bulges  that  non-stealthy 
aircraft  have.  Even  the  relatively  small  stealth  aircraft 
cany  their  ordnance  inside. 

There  are  many  other  changes  associated  with 
susceptibility  reduction  that  are  not  so  obvious.  Because 
of  the  stealthy  design,  the  flight  control  system  may 
have  to  contend  with  statically  unstable  aircraft 
Manufacturing  procedures  must  contend  with  different 
materials,  higher  tolerances,  and  complex  shaping 
requirements;  and  the  sensors  must  be  properly  located 
on  the  aircraft  to  minimize  their  contribution  to  the 
aircraft’s  signatures  while  maintaining  their  ability  to 
sense. 

Some  other  not-so-obvious  design  impacts  are 
related  to  the  requirements  associated  with  the  electronic 
warfare  equipment  carried  by  the  aircraft  This 
equipment  provides  the  concepts  of  threat  warning, 
noise  jamming  and  deceiving,  and  expendables. 
Adequate  space,  cooling,  and  electrical  power  for  the 
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processors,  sensors,  and  data  buses  put  additional 
requirements  on  the  design.  Should  the  countermeasures 
packages  be  carried  externally  or  internally.  Where  are 
the  antennas  located?  Will  they  affect  the  radar 
signature?  Another  not-so-obvious  impact  of 
susceptibility  reduction,  but  one  that  can  be  a  major 
contributor  to  aircraft  weight,  is  the  mission  flight 
profile.  Aircraft  are  designed  to  fly  a  particular  flight 
profile,  such  as  high-low-low-high.  With  this  profile, 
the  aircraft  takes  off,  climbs  to  high  altitude,  and 
efficiently  cruises  toward  the  target.  It  then  drops  down 
to  a  low  altitude  to  avoid  detection  by  the  enemy’s  air 
defense  sensors  and  high  altitude  SAMs  and  jinks  to 
avoid  being  hit  by  enemy  gunfire.  The  target  is  attacked 
at  low  altitude,  typically  with  a  pop-up  maneuver  to 
acquire  the  target.  After  attacking  the  target,  the  aircraft 
heads  for  home,  first  at  a  low  altitude  until  out  of  the 
enemy’s  weapon  envelopes,  and  then  at  a  high  altitude 
for  optimum  cruise  efficiency.  The  drop  down  to  low 
altitude,  which  is  solely  for  enhanced  survivability,  puts 
the  aircraft  in  a  much  more  severe  flight  environment. 
Drag  increases  significantly,  fuel  is  burned  at  a  much 
higher  rate  to  maintain  the  fast  speed  required  to  survive 
the  transit  through  the  enemy  territory,  and  the  air  loads 
on  the  aircraft  are  much  higher  than  those  at  high 
altitude  with  no  maneuvering.  One  of  the  most 
attractive  features  of  a  stealthy  aircraft  is  the  potential 
use  of  a  high-high-high  flight  profile;  it  keeps  the 
aircraft  out  of  the  range  of  the  ground-based  guns,  a 
long-time,  lethal  foe  of  aircraft. 


Vulnerability  Reduction 
Sam&General  Principles 

The  vulnerability  of  an  aircraft  is  reduced  by 
designing  the  aircraft  to  withstand  any  hits  by  the 
damage-causing  mechanisms  created  by  the  enemy 
warheads,  such  as  penetrators,  fragments,  incendiary 
particles,  and  blast.  This  is  acomplished  by  ensuring 
that  the  critical  components  on  the  aircraft  continue  to 
function  after  the  aircraft  is  hit.  Critical  components  are 
those  components  whose  loss  of  function  or  whose  kill 
mode  leads  to  the  loss  of  an  essential  function,  such  as 
lift,  thrust,  and  control  for  flight.  The  kill  modes 
associated  with  the  components  of  each  of  the  major 
systems  on  an  aircraft  are  listed  in  Table  4. 
Vulnerability  is  reduced  by  preventing  these  kill  modes 
from  occurring. 


The  vulnerability  reduction  features  used  on  the 
aircraft  of  WW II  were  the  result  of  wartime  experience. 
Most  of  the  aircraft  that  were  in  use  at  the  beginning  of 
the  war,  such  as  the  Fairey  Battle,  Brewster  Buffalo, 
Grumman  F4F  Wildcat,  and  Boeing  B-17,  were  either 
extensively  modified  during  the  war  to  make  them  more 
survivable  or  were  used  on  missions  with  low  threat 
levels.  An  excellent  paper  on  the  effects  of  enemy  gun 
fire  on  the  German  Ju-88  notes  that  the  cost  of  the  Ju- 
88s  lost  in  combat  was  the  largest  single  expenditure  of 
the  entire  program.  [6]  According  to  [6],  the  operations 
of  the  Ju-88  were  discontinued  in  1944  because  the 
opposition  of  the  Allies’  standard  pursuit  aircraft  had 
become  so  strong.  References  [1],  [3],  and  [7]  present 
many  of  the  vulnerability  features  used  on  several 
aircraft  of  the  WW  II.  Table  '  lists  some  of  these 
features.  Each  feature  was  incorporated  to  prevent  one  or 
more  of  the  kill  modes  listed  in  Table  4  from  occurring. 

The  Southeast  Asia  Conflict 

Marty  of  the  aircraft  that  fought  in  the  Southeast 
Asia  conflict  were  designed  for  high  altitude  fighting 
with  missiles  arxi  for  nuclear  war.  For  example,  the 
McDonnell  F-4  Phantom  II  was  originally  designed  as 
a  deck-launched  interceptor  for  the  U.S.  Navy  that 
would  dash  out  to  the  enemy  bombers  approaching  the 
carrier  and  kill  them  with  air-to-air  missiles.  There  was 
no  (or  very  little)  attention  paid  during  the  design  of  the 
F-4  (or  to  the  design  of  any  other  aircraft  of  that  era)  to 
the  damage  that  enemy  guns  or  guided  missiles  might 
do  to  the  aircraft.  Due  to  this  lack  of  attention  to 
Survivability  during  design,  the  U.S.  military  began  to 
lose  a  significant  number  of  aircraft  as  the  SEA  c  nflict 
intensified. 

Because  of  these  losses,  the  Air  Force  sent  a  fact¬ 
finding  team  into  the  area  in  1966  to  determine  the  loss 
cause(s).  The  team  interviewed  crew  members  who  had 
been  shot  down  and  recovered  and  the  wingmen  of  those 
not  recovered.  They  also  inspected  and  collected  data  on 
battle-damaged  aircraft  that  had  returned  to  base.  The 
battle  damage  data  was  used  to  determine  the  location 
and  types  of  damage  that  did  not  result  in  an  aircraft 
loss.  The  original  Air  Force  directive  that  identified  the 
problem  conjectured  that  the  aircraft  were  falling  out  of 
the  sky  because  of  damage  to  the  structure.  However, 
the  on-site  team  determined  that  the  single  most 
important  cause  of  aircraft  losses  was  actually  fuel 
system  fire  or  explosion.  Another  significant  cause  of 
aircraft  losses  was  damage  to  the  flight  control  system. 
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Often,  damage  to  the  redundant  (but  collocated) 
hydraulic  components  would  result  in  hard-over  control 
surface  failures  and  an  uncontrollable  aircraft,  forcing 
the  pilot  to  eject  -  if  he  could.  Many  of  the  control 
failures  were  caused  by  a  fuel  or  hydraulic  fluid  fire  that 
destroyed  the  control  components. 

After  the  first  Air  Force  team  returned  in  1966, 
they  recommended  a  number  of  actions  to  reduce  the 
future  loss  of  aircraft  All  were  approved  by  Air  Force 
Headquarters.  One  recommendation  was  to  conduct 
vulnerability  assessments  on  the  tactical  aircraft 
operating  in  North  Vietanm  (the  F-4,  RF-4,  F-105, 
and  RF-101)  and  to  develop  vulnerability  reduction 
retrofit-packages  based  upon  the  combat  data  collected 
and  the  vulnerability  assessments.  The  primary 
emphasis  was  on  the  suppression  of  fuel  system  fire  arri 
explosion  and  the  preven^on  of  loss  of  flight 
control.  Self-sealing  fuel  tanks  and  lines  and  the 
placement  of  flexible,  reticulated  polyurethane  orange 
foam  into  the  fuel  tanks  were  some  of  the  vulnerability 
reduction  features  designed  to  prevent  fuel-related  fires 
and  explosions. 

Features  designed  to  prevent  the  loss  of  control 
were  added  to  both  the  F-105  and  the  F-4.  A  stabilator 
lock  that  was  activated  by  the  pilot  if  all  hydraulic 
power  was  lost  at  the  stabilator  actuator  was  added  to 
the  F-105.  On  the  F-4,  an  Auxiliary  Power  Unit 
(APU)  was  added  to  the  stabilator  actuator,  arri  armor 
was  placed  below  the  hydraulic  components  Another 
change  to  the  flight  control  system  of  the  F-4 
concerned  the  hydraulic  power  supplied  to  the  aluminum 
aileron  actuators.  The  original  hydraulic  system 
consisted  of  two  primary  flight  control  systems,  PC  1 
and  PC2,  and  the  utility  system.  Both  PCI  and  PC2 
supplied  power  to  both  aileron  actuators.  Thus,  a  hit 
near  either  of  the  aileron  actuators  (or  a  fatigue  crack) 
could  damage  the  aluminum  actuator,  causing  the  loss 
of  both  PCI  and  PC2,  and  the  subsequent  loss  of  the 
aircraft  In  the  more  survivable  design,  the  aluminum 
actuators  were  replaced  with  steel  actuators,  and  the 
hydraulic  lines  were  replumbed,  with  utility  replacing 
PCI  in  one  wing  andPC2  in  the  other  wing.  With  this 
less  vulnerable  design,  a  hit  near  the  aileron  actuator 
could  cause  a  loss  of  PCI  and  utility,  or  PC2  ard 
utility,  but  not  both  PCI  andPC2.  [8] 

This  vulnerability  reduction  design  of  the  aileron 
hydraulic  system  saved  the  lives  of  at  least  24  air  crews 
that  were  flying  the  modified  F-4  when  they  lost  all 
hydraulics  in  one  wing.  Twelve  of  those  aircraft  were  in 
a  combat  zone.  The  resulting  savings  due  to  this 
particular  feature  were  estimated  to  be  $51M  (at  $2.5M 


per  aircraft)  plus  the  lives  of  the  24  air  crews.  The  cost 
of  the  modification  was  $9M,  but  it  would  have  been 
much  less  had  the  hydraulic  separation  been  in  the 
original  design.  [8]  There  are  many  other  examples  of 
aircraft  modifications  that  were  made  to  reduce 
vulnerabilities  that  were  discovered  in  combat.  Table  6 
lists  some  of  the  features  incorporated  on  the  aircraft 
that  fought  in  SEA.  These  features  were  added  to 
prevent  one  or  more  of  the  kill  modes  listed  in  Table  4. 
Many  of  them,  if  not  most,  were  retrofitted,  and  many 
also  contributed  to  aircraft  safety. 


Many  of  the  aircraft  flying  today  were  designed 
during  and  after  the  SEA  conflict.  The  lessons  learned  in 
combat  in  that  conflict  have  strongly  influenced  the 
o.esign  of  these  aircraft.  Three  of  these  ai  raft,  the  Air 
Force’s  A-10A  Thunderbolt  II  (affectionately  known  as 
the  Warthog),  the  Navy’s  F/A-18A  Hornet,  and  the 
Army’s  UH-60A  Blackhawk,  have  been  selected  as 
examples  to  illustrate  the  technology  for  reducing 
vulnerability  that  evolved  from  the  late  1%0’s  through 
the  middle  1980’s. 

The  A-lO’s  primary  mission  was  to  kill  tanks  with 
a  30mm  gun  and  air-to-surface  missiles.  In  this  role,  it 
would  lace  a  variety  of  guns  and  missiles,  and  it’s 
vulnerability  would  be  tested  in  combat.  Consequently, 
the  aircraft  was  the  first  modem  fixed-wing  aircraft  to 
be  designed  from  its  inception,  to  a  complete  set  of 
survivability  requirements.  It  incorporates  over  100 
vulnerability  reduction  features,  many  of  which  were 
verified  by  ballistic  testing.  In  Operation  Desert  Storm 
in  1991,  the  A-10  had  an  opportunity  to  show  what  it 
could  do.  According  to  Air  Force  Capt.  Paul  Johnson, 
who  flew  home  from  a  mission  over  Kuwait  with  a 
gaping  hole  in  his  A-lO’s  right  wing,  “We  always 
expected  the  A-10  to  be  a  tough  customer,  but  it  hadn’t 
been  proven.”  [9]  The  survivability  and  battle  damage 
repair  features  that  were  designed  into  the  A-10  ‘paid 
off  in  Desert  Storm.  According  to  an  article  in 
Aviation  Week  &  Space  Technology,  “Survivability 
features  designed  into  the  Fairchild  A-10  proved  their 
worth  during  its  first  exposure  to  combat  in  Operation 
Desert  Storm,  when  many  Thunderbolts  flew  home 
despite  extensive  battle  damage  sustained  in  successful 
low-level  attacks  on  enemy  tanks  and  artillery.  ...  Most 
of  the  damaged  aircraft  were  returned  quickly  to  service 
by  U.S.  Air  Force  aircraft  battle  damage  repair  (ABDR) 
crews.  ...  Of  20  aircraft  that  were  at  least  ‘significantly’ 
damaged,  only  one  could  not  be  returned  to  service  by 
ABDR  crews  ...  .”  [10]  According  to  Capt.  Johnson, 
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“The  guys  developed  a  great  affection  for  the  airplane 
and  a  very  healthy  respect  for  what  it  could  absorb.”  [9] 

TheF/A-18  was  the  Navy’s  first  aircraft  in  which 
survivability  considerations  played  a  major  role  in  the 
design.  Trade-off  studies  were  performed  to  determine 
the  payoffs  and  costs  associated  with  each  enhancement 
feature  considered  Those  features  that  had  high  pay-offs 
with  relatively  low  costs  were  incorporated  because  the 
Hornet  is  both  a  fighter  and  an  attack  aircraft  and  had  to 
perform  well  in  both  roles.  The  F/A-18  is  the  Navy’s 
most  survivable  aircraft  flying  today.  It,  too,  proved 
itself  to  be  a  survivable  aircraft  in  Desert  Storm. 

Because  of  the  large  number  of  Army  helicopters 
lost  to  small  arms  fire  in  SEA,  the  UH-60,  which  was 
the  winning  design  for  the  Utility  Tactical  Transport 
Aircraft  System  (UTTA~,  ompetiiion,  had  a  firm 
design  requirement  on  vulnerability.  The  helicopter  in 
forward  flight  was  to  be  capable  of  safe  flight  for  at 
least  30  minutes  after  a  single  hit  by  a  7.62mm  API 
projectile.  [11]  In  the  vernacular  of  the  vulnerability 
engineer,  the  helicopter  must  have  zero  vulnerable  area 
for  a  B  level  attrition  kill.  A  minimum  vulnerable  area 
to  the  23mm  HEI  was  a  design  goal.  The  reduced 
vulnerability  paid  off  in  Grenada.  "The  BLACKHAWK 
played  a  key  role  in  combat  during  the  1983  Grenada 
invasion.  ...  It  sustained  and  survived  small  arms  and 
23mm  anti-aircraft  fire  while  carrying  out  its  mission  of 
transporting  and  supporting  Army  Rangers.  Of  the  32 
BLACKHAWKS  used  in  Grenada,  ten  were  damaged  in 
combat.  One  helicopter  had  45  bullet  holes  that 
damaged  the  rotor  blades,  fuel  tanks,  and  control 
systems,  yet  it  still  managed  to  complete  its  mission." 
[12] 

To  illustrate  the  state-of-the-art  of  vulnerability 
reduction  design  in  the  recent  past,  the  vulnerability 
reduction  features  used  on  the  A-10A,  F/A-18A,  and 
the  UH-60A  to  prevent  the  system  kill  modes  from 
occurring  are  given  in  Tables  7a-e  and  Figs.  1-3  for  the 
major  systems.  [13,  14,  and  15]  All  three  aircraft,  as 
well  as  the  F-117  and  many  of  the  other  aircraft 
involved  in  the  operation,  proved  themselves  to  be 
survivable  aircraft  in  Desert  Storm.  They  took  some 
hits,  but  suffered  very  few  losses.  This  combat 
experience  validated  the  approach  to  survivability  design 
that  was  taken  during  1970’s  and  80’s. 


Testing  for  Survivability 

The  current  generation  of  operational  aircraft,  as 
well  as  those  in  development,  are  undergoing  extensive 
life  fire  testing.  The  Joint  Live  Fire  (JLF)  test  program, 
initiated  in  the  early  1980’s,  has  tested  the  F-15,  F-16, 
F/A-18,  AV-8B,  UH-60A,  and  AH-64A  to  both  non¬ 
explosive  and  explosive  ballistic  projectiles.  The 
congressionally  mandated  Live  Fire  Test  (LFT)  law  for 
aircraft  in  development,  passed  in  FY87,  requires 
realistic  vulnerability  tests  on  the  complete  aircraft, 
with  all  combustibles  on-board,  using  weapons  likely 
to  be  encountered  in  combat.  If  such  tests  are 
unreasonably  expensive  and  impractical,  a  waiver  must 
be  approved  by  the  Secretary  of  Defense  prior  to  the 
entry  into  Engineering  and  Manufacturing 
Development,  and  an  alternate  realistic  test  program 
p  an  must  be  submitted  and  approved  Vulnerability 
testing  of  components  and  subsystems  early  in  the 
development  cycle  is  strongly  encouraged  in  order  to 
identify  vulnerabilities  and  eliminate  them  without 
major  weight  and  cost  penalties.  The  law  has  had  a 
major  beneficial  effect  on  the  vulnerability  reduction  of 
many  of  the  aircraft  currently  operational,  as  well  as 
those  in  development,  and  this  beneficial  effect  should 
continue  into  the  future.  [16] 

Present  and  Future  Designs  for  Survivability 

The  current  generation  of  military  tactical  aircraft 
now  in  development  or  low  rate  initial  production,  e.g., 
the  F-22,  F/A-18E/F,  V-22,  and  RAH-66,  have 
strong  survivability  requirements.  The  C-17  is  the  first 
cargo  aircraft  with  survivability  requirements  on  the 
original  design  because  its  mission  requires  it  to  go  in 
harm’s  way.  Both  susceptibility  and  vulnerability  are 
being  reduced  using  the  technology  that  has  evolved 
over  the  last  thirty  years.  A  balanced  design  between 
susceptibility  and  vulnerability  issues  is  achieved  using 
trade-off  studies  to  determine  the  proper  balance  for  the 
different  aircraft  with  their  different  missions.  This 
approach  is  expected  to  continue  into  the  future,  with  an 
improved  capability  for  conducting  integrated 
survivability  assessments  and  trade-off  studies, 
including  tactics,  electronic  warfare,  and  signature 
reduction,  developed  through  the  efforts  of  the 
JTCG/AS  and  others. 

The  designer  of  future  aircraft  will  face  different 
problems  when  trying  to  design  survivable  aircraft,  but 
the  fundamental  approches  to  solving  those  problems 
remains  the  same:  reduce  susceptibility  and  reduce 
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vulnerability.  One  of  the  survivability  issues  on  aircraft 
in  design  today,  as  well  as  those  of  the  future,  is  the 
increased  use  of  composite  materials,  which  affect  (1)  an 
aircraft’s  signatures,  and  hence  susceptibility,  (2)  its 
structural  vulnerability',  and  (3)  the  ability  to  rapidly 
repair  battle  damage.  Other  issues  are  the  possible 
reduction  in  the  number  of  engines  on  an  aircraft  due  to 
the  increase  in  engine  reliability,  the  trend  toward  an  all 
or  mostly  electric  aircraft,  the  significant  increase  in  the 
reliance  on  avionics,  with  digital  data  buses  transporting 
flight  critical  signals  throughout  the  aircraft,  and  the 
mandated  requirement  to  find  a  replacement  for  the 
current  fire  extinguishing/fuel  tank  inerting  systems 
that  use  a  environmentally  destructive  gas,  such  as 
Halon  1301. 


Conclusions 

Survivability  has  come  a  long  way  in  the  past 
thirty  years.  It  is  now  a  combat  tested,  critical  system 
characteristic,  with  performance  requirements,  an 
enhancement  technology,  and  an  assessment 
methodology.  The  original  goal  of  the  JTCG/AS  in 
1971  to  establish  survivability  as  a  design  discipline 
has  been  achieved.  This  goal  has  been  reached  because 
the  U.S.  military  Services  have  learned  that  aircraft  that 
have  not  been  designed  to  survive  in  combat  are  not 
effective  in  combat. 

However,  there  are  many  changes  that  are  either 
here  now  or  are  looming  ahead  that  can  impact  the 
survivability  of  those  aircraft  that  will  be  operating  in 
the  twenty-first  century.  The  affordability  of  modem 
military  aircraft  has  become  a  major  issue,  with  the 
potential  consequence  of  less  survivable  aircraft  because 
of  a  chance  on  relatively  inexpensive,  off-the-shelf, 
peacetime  designs.  The  a^.^rs  believe  that  when 
procuring  affordable  military  aircraft,  survivability  must 
not  ‘drop  through  the  crack’  because  of  the  elimination 
of  the  military  specifications  and  standards  that  have 
become  a  controversial  issue.  Military  aircraft  must  be 
designed  to  fight  and  survive  in  wartime,  not  just  to  fly 
in  peacetime. 

The  Department  of  Defense  (DoD)  is  downsizing, 
and  the  availability  of  people  to  pay  attention  to  those 
details  that  are  unique  to  combat  may  decline.  The 
authors  believe  that  as  DoD  downsizes,  the  resources, 
personnel,  and  facilities  required  for  survivability 
assessment,  design,  and  test  and  evaluation,  must  not  be 
downsized  below  a  critical  mass.  Providing  support  to 
program  managers,  developing  new  technology,  and 


conducting  realistic  live  fire  and  operational  tests  to 
evaluate  susceptibility,  vulnerability,  and  survivability 
requires  an  investment  for  the  security  of  the  nation. 

Finally,  the  identification  of  the  specific  threats  to 
future  aircraft  is  difficult,  at  best,  which  may  lead  some 
people  to  the  conclusion  that  there  are  no  serious  threats 
to  contend  with;  and  if  there  are  no  threats,  survivability 
can  be  ignored.  The  authors  believe  that  history  has 
shown,  and  will  continue  to  show,  that  there  is  always 
another  threat  waiting  just  around  the  comer.  Having 
aircraft  available  that  are  both  lethal  and  survivable  will 
help  to  dissuade  potential  adversaries  from  any  foolish 
action. 

In  conclusion,  the  authors  believe  that  if  the 
survivability  community  continues  to  work  together  in 
ihe  future,  as  it  has  in  the  past,  then  survivability'  as  a 
design  discipline  will  continue  to  mature,  and  the  U.S. 
military  aircraft  of  the  future  will  be  more  survivable 
and  thus  more  effective. 
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Table  1  Some  Typical  Survivability  Enhancement  Features 


Speed  and  altitude 

Maneuverabilitv/agility 

Chaff  and  flares 

Fire/explosion  protection 

Terrain  following 

Hydraulic  ram  protection 

Self-repairing  flight  controls 

No  fuel  adjacent  to  air  inlets 

Rugged  structure 

Lethal  stand-off  weapons 

Self-defense  missiles  and  guns 

Good  target  acquisition  capability 

Night-time  capability 

Crew  situational  awareness 

Threat  warning  system 

More  than  one  engine  -  separated 

Fighter  escort 

Mission  planning  system 

Low  signatures  or  observables 

Crew  skill  and  experience 

'  1  1  . Hi  1  mil 

Tactics 

Nonflammable  hydraulic  fluid 

Armor 

On-board  electronic 

Redundant  and  separated 

Stand-off  electronic 

countermeasures 

hydraulics 

countermeasures 

Table  2  The  Twelve  Survivability  Enhancement  Concepts  [1] 


Susceptibility  Reduction 

Vulnerability  Reduction 

Threat  warning 

Component  redundancy  (with  separation) 

-  missile  approach  warning  receiver 

-  two  widely  separated  engines 

Noise  jamming  and  deceiving 

Component  location 

-  ALQ-126B  on-board  ECM 

-  no  fuel  adjacent  to  air  inlets 

Expendables 

Passive  damage  suppression 

-flares 

-  explosion  suppression  foam  in  fuel  tank  ullages 

Signature  reduction 

Active  damage  suppression 

-  shaping  to  reduce  the  radar  signature 

-  fire  detection  and  extinguishing  in  engine  bays 

Threat  suppression 

Component  shielding 

-anti-radiation  missile 

-armored  seats 

Tactics,  performance,  &  crew  skill  &  experience 

Component  elimination/replacement 

-  terrain  following 

-  nonflammable  hydraulics 

Table  4  A  List  of  System  Damage-Caused  Failure  (Kill)  Modes  [  1  ] 


Euel 

Fuel  supply  depletion 
In-tank  fire/explosion 
Void  space  fire/explosion 
Sustained  exterior  fire 
Hydraulic  ram 


Bower  Train  and  Rotor  Blade/Propeller 
Loss  of  lubrication 
Mechanical/structural  damage 


Electrical  Power 
Severing  or  grounding 
Mechanical  failure 
Overheating 


Propulsion 
Fuel  ingestion 
Foreign  object  ingestion 
Inlet  flow  distortion 
Lubrication  starvation 
Compressor  case  perforation 
or  distortion 

Combustor  Case  perforation 
Turbine  section  failure 
Exhaust  duct  failure 
Engine  controls  and 
accessories  failure 


Armament 

Fire/Explosion 


Elight  Control 

Disruption  of  control  signal  path 
Loss  of  control  power 
Loss  of  aircraft  motion  data 
Damage  to  control  surfaces  and 
hinges 

Hydraulic  fluid  fire 


Structural 
Structure  removal 
Pressure  overload 
Thermal  weakening 
Penetration 


Crew 

Injury,  incapacitation,  or  death 


Avionics 

Penetrator/fragment  damage 
Fire/explosion/overheat 


7  Aircraft  1980-1989  7  Aircraft  1970-1979  15  Aircraft  1960-1969  19  Aircraft  1950-1959 


Table  3  New  U.S.  Military  Aircraft  Starts  (Approximate  Dates) 


Army 


Air  Force 


F-102,  F-106 
F-100,  F-101 


F-104,  F-105 


F-8.A-4 

A^3”F-4 


CH— 47 


CH-46,  E-2 
H-3,  A-5 
A-6,  P-3 
H-2 


OH-6 


AH-1 


F-111,  C-141 

F-4C,  F-5  CH-53 

. A-37 . A-7 

ov-io  « 

q_5  Vulnerability 

a  consideration 

A-7D 


Many  survivability 
features  built  in  — 


AH-64 

UH-€0 


F-15  F-14,  S-3 

Vulnerability  a 
^/major  consideration 

A— 10  Lightweight  fighter 

F-iS'^4  with  some  toughness 


'X  Originally  a  FI  A— 1 8 

British  design"'^-  AV-8B 
Designed  to  take  a  single  hit  anywhere 
on  the  aircraft  and  fly  for  30  minutes 


First  generation 
of  stealth  - 6 


Second  generation 
of  stealth  '  ' - - 


F-117 
C-17*  - 


F-15E 

►  B -r 

rF-22* 


^Survivability 

requirements 


V-22* 

A-12** 


Third  generation 
of  stealth 


RAH-66* 


Significant 
*r...  survivability . 
. in  the  design" 


First  Navy  aircraft  with 
significant  consideration 
of  survivability 


F/A-18E/P 


Survivability 
requirements 
for  all  threats 


Strongest  survivability 
requirements  to  date 


Desert  Storm 


*  =  in  development  or  limited  production 
**  =  cancelled 
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Table  5  Some  Vulnerability  Reduction  Features  used  on  WW II  Aircraft 


Armor  plating 

Self-sealing  fuel  tanks 

Location  of  cooling  and  lubrication  components 

Fuel  venting  and  void  space  filling 

Bullet-proof  glass  canopy 

Fuel  tank  ullage  inerting 

Rugged  construction 

Fuel  tank  depressurization 

Air-cooled  engines 

Fire  extinguishing  (crew  and  engines) 

Emergency  extension  of  landing  gear 

Fuel  tank  cross-over  lines  with  shut-off  valves 

Back-up  propeller  feathering  subsystem 

Firewalls 

Table  6  Some  Vulnerability  Reduction  Features  used  on  SEA  Aircraft 


Orange  foam  in  fuel  tanks 

Rerouted  hydraulics  in  wings 

Back-up  flight  controls  and  surfaces 

Added  APU 

Stabilator  lock 

Independent,  self-sealing  fuel  feed  tanks  and  lines 

Bomb  bay  fire  extinguishers 

Ram  air  emergency  power  package 

Improved  self-sealing  fuel  tanks 

Emergency  pressurization  for  fuel  transfer 

Steel  liners  added  to  aluminum  hydraulic  barrels 

Armor 

Table  7a  .e  Vulnerability  Reduction  Feanires  used  on  the  Fuel  System  of  the  A-i  jA, 

F/A-18A,  and  UH-60A  Aircraft 


A-10A  |  F/A-18A  I  UH-60A 


Kill  Mode:  Fuel  Supply  Depletion 


Two  self-sealing  feed  tanks 
located  away  from  ignition 
sources 

Two  self-sealing  feed  tanks 
located  away  from  ignition 
sources 

Two  self-sealing/crashworthy 
tanks  located  away  from  ignition 
sources 

Short,  self-sealing  feed  lines 

Short,  self-sealing  feed  lines 

Short  self-sealing  feed  lines 

Wing  fuel  used  first 

Wing  fuel  used  first 

Engine-mounted  suction  pumps 

Most  fuel  lines  located  inside 
tanks 

Most  fuel  lines  located  inside 
tanks 

Cross  feed  capability 

Cross  feed  capability  located 
within  tanks 

Cross  feed  capability 

Redundant  feed  flow 

Backup  pump  and  redundant  feed 

Kill  Mode:  Fire/Explosion 

Two  self-sealing  feed  tanks 
located  away  from  ignition 
sources 

Two  self-sealing  feed  tanks 
located  away  from  ignition 
sources 

Two  self-sealing/crashworthy 
tanks  located  away  from  ignition 
sources 

Short  self-sealing  feed  lines 

Short  self-sealing  feed  lines 

Short,  self-sealing  feed  lines 

Most  fuel  lines  located  inside 
tanks 

Most  fuel  lines  located  inside 
tanks 

Engine-mounted  suction  pumps 

Open  cell  foam  in  all  tanks 

Open  cell  foam  in  wing  tanks 

Closed  cell  foam  around  tanks 

Closed  cell  foam  in  dry  bays 
around  tanks 

Closed  cell  foam  under  two 
fuselage  tanks 

Draining  and  vents  in  vapor  areas 

Kill  Mode:  Hydraulic  Ram 

Minimum  fuel  in  wings  during 
combat 

Minimum  fuel  in  wings  during 
combat 

Crashworthy  fuel  tanks  also 
hvdrodvnamic  tolerant 

Damage  control  design  of  short 
length  of  inlet  next  to  fuel  tank 
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Table  7b  Some  Vulnerability  Reduction  Features  used  on  the  Propulsion  System  of  the  A- 10 A, 

F/A-18A,  and  UH-60A  Aircraft 


A-10A 

I  F/A-18A 

UH-60A 

Kill  Mode:  Loss  of  Thrust 

Two  widely  separated  engines 

Two  engines 

Two  widely  separated  engines 

Dual  fire  walls 

Fire  walls  between  engine, 

AMAD,  and  APU 

Titanium  fire  walls 

Fail-active  fire  detection  with  two 

Fire  detection  with  two  shot  fire 

shot  fire  extinguishing 

extinguishing  system 

extinguishing 

Engine  case  armor 

Blade  containment  for  fen, 
compressor,  and  turbine 

Widely  separated  engine  to 
transmission  input  modules 

Separation  between  fuel  tanks  and 
air  inlets 

Inlet  duct/fuel  tank  hydrodynamic 
ram  damage  control 

No  fuel  ingestion 

One  engine  out  capability 

One  engine  out  capability 

1 

Table  7c  Some  Vulnerability  Reduction  Features  used  on  the  Flight  Control  System  of  the  A-10A, 

F/A-18A,  and  UH-60A  AL  craft 


A-10A  I  F/A-18A  1  UH-60A 

Kill  Modes:  Disruption  of  Control  Signal  Path  and  Loss  of  Control  Surfaces 

Two  independent,  separated 
mechanical  flight  controls  with 
mechanical  disconnects 

Two  independent,  separated 
mechanical  flight  controls  with 
mechanical  disconnects 

Two  rudders  and  elevators 

Backup  mechanical  controls  to 
tail 

Tail  rotor  is  stable  if  pitch  rod  is 
severed 

Armor  around  stick  where 
redundant  controls  converge 

Controls  are  ballistically  tolerant 

Kill  Modes:  Loss  of  Control  Power  and  Hydraulic  Fluid  Fire 

Two  independent,  separated  h  1 
power  subsystems 

Two  independent,  separated,  and 
shielded  hyd  power  subsystems 

VC  can  be  controlled  without 
hyd  power  with  mech  controls  and 
dual,  electrically  powered  trim 
actuators 

Rip-stop  actuators 

Third  electrically  driven  backup 
can  power  either  or  both  primary 
subsystems  with  quick 
disconnects  and  leak  isolation 
valves 

Less  flammable  hyd  fluid 

Less  flammable  hyd  fluid 

Less  flammable  hvd  fluid 

Reservoir  level  sensing 
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Table  7d  Some  Vulnerability  Reduction  Features  used  on  the  Air  Crew  System  of  the  A-10A, 

F/A-18A,  and  UH-60A  Aircraft 


A-10A 

F/A-18A 

1  UH-60A 

Kill  Modes:  Incapacitation  or  Death 

Pilot  sits  in  a  titanium/aluminum 

Crashworthy  armored  seats  and 

armor  bathtub 

retention  system 

Spall  shields  between  armor  and 
pilot 

Shatterproof  cockpit  window 

Bullet  resistant  windscreen 

Minimum-spall  materials  used  in 
cockpit 

Spall  resistant  canopy  side  panels 

Kevlar  armor  to  stop  HEI 
fragments 

Table  7e  Some  Vulnerability  Reduction  Features  used  on  the  Rotor  Blade  &  Drive  Train 

of  the  UH-60  A  Aircraft 


UH-60A 


Kill  Modes:  Loss  of  Lubrication  and  Structural  D 


Main  Transmission 


Modularized  transmission 
eliminates  exposed  high  speed 
shafts  and  multiple  lube  systems 
with  exposed  oil  components 


Operates  more  than  one  hour  after 
loss  of  all  oil 


Noncatastrophic  failure  allows 
autorotation 


Main  rotor 


Rotor  blades  tolerant  to  HEI 
projectiles 


Elastomeric  hub  with  no  lube, 
tolerant  to  HEI  projectiles 


Tail  Rotor  Drive  System 


Large  vertical  tail  with  log  boom 
provides  anti-torque  in  forward 
flight 


Shaft  supports  provide  damping 
for  damaged  shaft 


No  bearings  or  lube  in  cross¬ 
beam  rotor 


Tail  rotor  blades  ballistically 
tolerant 


Damaged  parts  thrown  away  from 
the  helicopter 


Fig.  2  Some  Vulnerability  Reduction  Features  on  the  F/A-l  8  A  (Courtesy  of  McDonnell  Aerospace) 
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Triple  Redundant, 
Separated  Hydraulic 
and  Electrical  Systems 


23mm  Tolerant 
Main  Rotor  Blades 


Low  Spall 
Windshield 
and  Cockpit 
Structure 


Ballistically  Tolerant 
Upper  Controls 
and  Hub 

Superior 
Engine 
Out 

Performance 

Tolerant 


Large  Vertical  Stabilizer 
Area  Provides  Inherent 
Direction  Stability  After 
Tail  Rotor  Loss 


23mm 

Tolerant 

Structure 


Fail-Safe 
Tail  Rotor 
Controls 


Ballistically 
Tolerant 
Tail  Rotor 
Blades 


Ballistic 
Protection 
for  Gearbox 
Bearings 


Redundant  Suction  Fuel  System  with 
Self-Sealing  Fuel  Tanks  and  Lines 

Modularized  Main  Transmission  System 
with  Dual  Lubrication  System 


Armored  Pilot  and 
Copilot  Seats  with 
One-Piece  Bucket 


Redundant  and 
Separated  Main 
Rotor  Flight  Controls 


Fig.  3  Some  Vulnerability  Reduction  Features  on  the  UH-60A  (Courtesy  of  Sikorsky  Aircraft  Division) 
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AIRLINE  SAFETY  &  SECURITY:  AN  INTERNATIONAL  PERSPECTIVE 


ADMIRAL  GORMLEY,  LADIES  AND  GENTLEMEN,  IT  IS  WITH  GREAT  PLEASURE 
THAT  I  AGAIN  SPEAK  WITH  YOU  OF  “THE  VIEW  FROM  THE  FLIGHT  DECK”  ON 

THE  SUBJECT  OF  AIRLINE  SAFETY  AND  SECURITY . YOUR  INTEREST  IS  TRULY 

APPRECIATED.  I  NOTE  THAT  SINCE  I  HAD  THE  PRIVILEGE  OF  ADDRESSING 
MANY  OF  YOU  IN  ST.  LOUIS  IN  OCTOBER  OF  1993  ADPA  AND  NSIA  HAVE 
FORMALLY  JOINED  TOGETHER  BECOMING  NDIA.  MAY  I  CONGRATULATE  YOU  ON 
SO  DOING. 

AS  THE  FIELD  OF  INTERNATIONAL  CIVIL  AVIATION  IS  SUCH  A  HIGHLY  VISIBLE 
AND  THEREFORE  OFTEN  CHOSEN  TARGET  OF  THE  TERRORIST,  WE  IN  THE 
BUSINESS  OF  COMMERCIAL  AVIATION  MUST  ALWAYS  STRIVE  TO  PROTECT  THE 
LIVES  OF  OUR  PASSENGERS,  CREW,  AND  GROUND  PERSONNEL  AND  THE 
SAFETY  OF  OUR  AIRCRAFT  AND  AIRPORTS  REGARDLESS  OF  WHETHER  THE 
THREAT  IS  ONBOARD  THE  AIRPLANE  FROM  A  HIJACKING  OR  EXPLOSIVE 
DEVICE,  A  DEVICE  PLANTED  WITHIN  OUR  AIRPORT,  OR  FROM  OUTSIDE  THE 
AIRCRAFT  OR  AIRPORT  IN  THE  FORM  OF  A  MISSILE.  IT  IS  ONLY  THROUGH 
COOPERATION.  COORDINATION.  AND  COMMUNICATION  THAT  THESE  THREATS 
CAN  BE  MANAGED.  TO  THAT  END,  I  WISH  TO  CONGRATULATE,  ON  BEHALF  OF 
IFALPA,  THE  ORGANIZERS  AND  SPONSORS  OF  THIS  SYMPOSIUM  FOR  THEIR 
EFFORTS.  I  AM  VERY  MUCH  LOOKING  FORWARD  TO  OUR  UPCOMING  SESSIONS. 

THE  SUBJECT  OF  AIRCRAFT  SURVIVABILITY  IS  SO  FUNDAMENTAL  TO  OUR 
MISSION  OF  SAFE  TRANSPORTATION  OF  OUR  PASSENGERS  AND  OUR  FREIGHT 
REGARDLESS  OF  WHAT  TOTALLY  UNEXPECTED  EVENTS  MAY  TAKE  PLACE  ON 
OUR  FLIGHT,  THAT  WE  CONSIDER  IT  TO  BE  ONE  OF  THE  BASIC  TECHNOLOGIES 
ON  WHICH  THE  FUTURE  OF  OUR  INDUSTRY  DEPENDS. 

I  WOULD  LIKE  TO  PARTICULARLY  ACKNOWLEDGE  PROF.  BALL,  WHO,  THROUGH 
HIS  TEXT,  THE  FUNDAMENTALS  OF  AIRCRAFT  COMBAT  SURVIVABILITY 
ANALYSIS  AND  DESIGN.  CONTRIBUTED  SO  MUCH  TO  MY  UNDERSTANDING  OF 
THOSE  FUNDAMENTALS  AS  THEY  APPLY  IN  THIS  PRESENTATION 

I  ADDRESS  YOU  TODAY  ON  BEHALF  OF  THE  INTERNATIONAL  FEDERATION  OF 
AIR  LINE  PILOT’S  ASSOCIATIONS  OR  IFALPA.  IFALPA  IS  A  WORLDWIDE 
FEDERATION  OF  PILOT  REPRESENTATIVES  OF  97  COUNTRIES  AROUND  THE 
WORLD.  THE  FEDERATION  IS  HEADQUARTERED  IN  LONDON  SERVING 
PRIMARILY  AS  A  TECHNICAL  ORGANISATION  WITHOUT  A  POLITICAL  AGENDA. 

IT  MAY  BE  HELPFUL  TO  SET  THE  STAGE  BY  PROVIDING  A  BIT  OF  BACKGROUND 
ABOUT  IFALPA’S  SECURITY  COMMITTEE  AND  ITS  PURPOSE.  IFALPA’S 
SECURITY  COMMITTEE  WORKS  WELL  DESPITE  THE  FACT  THAT  ITS 
MEMBERSHIP  COMES  FROM  VERY  DIVERSE  BACKGROUNDS  ACROSS  THE 
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WORLD.  THIS  BECAUSE  OF  ITS  SINGULARITY  OF  PURPOSE.  THE  PREMISES  OF 
AVIATION  SECURITY  ARE  SO  SPECIFIC  THAT  WE  ARE  IN  VERY  CLOSE  ACCORD 
ON  VIRTUALLY  ALL  AVSEC  PRINCIPLES  SO  CLOSELY  RELATED  TO  THE  SAFETY 
OF  OUR  PASSENGERS  WHO  ENTRUST  THEIR  LIVES  AND  THOSE  OF  THEIR 
LOVED  ONES  INTO  OUR  HANDS.  MAY  I  INQUIRE  AS  TO  HOW  MANY  OF  YOU 
SUBCONSCIOUSLY  COUNTED  ON  THAT  TRUST  WHEN  YOU  DEVELOPED  YOUR 
TRAVEL  PLANS  FOR  OUR  SYMPOSIUM? 

WE  SPEAK  WITH  ESSENTIALLY  ONE  VOICE  THAT  IS  IN  MANY  RESPECTS  VERY 
CLOSE  TO  THOSE  OF  THE  INTERNATIONAL  CIVIL  AVIATION 
ORGANISATION  (ICAO),  THE  INTERNATIONAL  AIR  TRANSPORT 
ASSOCIATION  (IATA),  AND  AIRPORTS  COUNCIL  INTERNATIONAL  (ACI). 

HENCE,  WE  WORK  IN  VERY  CLOSE  ACCORD  WITH  THOSE  ORGANISATIONS. 

SANDRA  MEADOWS,  IN  THE  SEPTEMBER  ISSUE  OF  “NATIONAL  DEFENSE”, 
STATED  THA^  “MORE  U.S.  SERVICE  MEN  HAVE  LOST  THEIR  LIVES  TO 
TERRORISTS  DURING  THE  PAST  20  YEARS  THAN  HAVE  BEEN  KILLED  IN 
COMBAT,  ACCORDING  TO  PENTAGON  ESTIMATES”. 

IN  THE  WORDS  OF  BRIG.  GEN.  JAMES  CONWAY,  USMC,  DEPUTY  DIRECTOR 
FOR  COMBATING  TERRORISM,  JCS,  “MILITARY  COMMANDERS  DEPLOYED 
OVERSEAS,  PARTICULARLY,  ARE  ACUTELY  AWARE  THAT  TERRORIST  FORAYS 
AGAINST  U.S.  FORCES  WILL  NOT  ONLY  LEAD  TO  CASUALTIES  BUT  ALSO  TO 
THE  LOSS  OF  PUBLIC  SUPPORT  FOR  MILITARY  DEPLOYMENTS.” 

“POTENTIAL  U.S.  ENEMIES  KNOW  THAT  THIS  COUNTRY,  DESPITE  ITS 
OVERWHELMING  MILITARY  MIGHT,  HAS  A  ‘CRITICAL  VULNERABILITY’. 
BECAUSE  THE  AMERICAN  PUBLIC  CAN  SEE  EVENTS  UNFOLD  ON  LIVE  TV,  U.S. 
ENEMIES  KNOW  THAT  AT  THE  SIGHT  OF  BLOODSHED,  AMERICANS  WILL 
IMMEDIATELY  QUESTION  THE  PURPOSE  OF  THAT  MILITARY  MISSION  -  AND 
WHETHER  IT  IS  WORTH  l  S.  LIVES.  THAT  MEANS  A  THIRD  WORLD  NATION  CAN 
GET  AT  OUR  NATIONAL  POLICIES'  BY  DOMINATING  THE  SIX  O’CLOCK  NEWS, 
SAYS  GEN.  CONWAY”. 

AN  ACT  OF  TERRORISM,  OR  EVEN  AN  ACCIDENT  THAT  IS  PER-  CEIVED  TO 
HAVE  BEEN  RESULTING  FROM  AN  ACT  OF  TERRORISM  AGAINST  OUR  INDUSTRY 
SENDS  THE  PUBLIC  SCURRYING  TO  THEIR  TELEPHONES  TO  CANCEL  THEIR  AIR 
TRAVEL  PLANS. 

“TERRORISM  -  THE  THEATRE  OF  THE  OBSCENE.”  I  STRONGLY 
SUGGEST  THAT  WE  -  THE  MILITARY  AND  THE  AIRLINE  INDUSTRY  -  HAVE  A 
COMMON  THREAT  HERE  OF  MAJOR  PROPORTION  AND  MASSIVE  DIVERSE 
POTENTIAL  IMPACTS.  NOT  ONLY  DO  WE  BOTH  LOSE  LIVES;  YOU  LOSE  PUBLIC 
SUPPORT;  WE  LOSE  BUSINESS.  THE  PUBLIC,  INCLUDING  THE  TRAVELING 
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PUBLIC,  EXPERIENCES  A  PSYCHOLOGICAL  IMPACT  THAT  CAN  AND  OFTEN 
DOES  RESULT  IN  A  REDUCTION  OF  THEIR  FAITH  IN  GOVERNMENT  AND 
INDUSTRY;  MANIFESTING  AS  THE  LOSS  OF  THE  PEACE  OF  MIND  AND  A  PART 
OF  THAT  DEEP  FEELING  OF  INNER  SECURITY  HOPEFULLY  EXPERIENCED  BY  A 
POPULATION.  FURTHER,  AVIATION  SECURITY  IS  A  NATIONAL  SECURITY 
PROBLEM. 

“MEETING  SURVIVABILITY  AND  SAFETY  CHALLENGES  FOR  THE  21  ST 
CENTURY”.. .THERE  HAS  BEEN  SINCE  THE  LOSS  OF  TWA  800  A  FUNDAMENTAL 
SHIFT  WITHIN  THE  UNITED  STATES  GOVERNMENT  AND  THE  AVIATION 
INDUSTRY.  THERE  IS  NOW  AN  AGREEMENT  THAT  THERE  SHOULD  BE  A  NEW 
BASELINE  OF  SECURITY;  AN  UPGRADING  OF  SECURITY  WITHIN  OUR  INDUSTRY 
THAT  SETS  A  NEW  “BOTTOM  RUNG  OF  THE  LADDER”,  SO  TO  SPEAK.  IN 
ACCORDANCE  WITH  THIS  CONCEPT,  THE  BASELINE  WORKING  GROUP  OF  THE 
GORE  COMMISSION  WAS  CREATED.  AMONG  THE  RECOMMENDATIONS  OF  THIS 
GROUP  (CONSISTING  OF  nEPRESENTATIViS  OF  INVOLVED  GOVERNMENT 
AGENCIES,  AND  VARIOUS  INDUSTRY  GROUPS)  ARE:  A  BROAD  EMPLACEMENT 
OF  FAR  MORE  SOPHISTICATED  EXPLOSIVES  AND  WEAPONS  DETECTION 
SYSTEMS  (COMPUTED  TOMOGRAPHY  AND  UPGRADED  X-RAYS),  IMPROVED 
SELECTION  AND  TRAINING  FOR  THOSE  WHO  WILL  BE  OPERATING  THE 
EQUIPMENT,  AND  ASSESSMENT  OF  THE  VIABILITY  OF  ANTI-MISSILE  DEFENSE 
SYSTEMS. 

WE  AT  IFALPA  BELIEVE  THAT  THE  GREATEST  SINGLE  AVIATION  THREAT  IS  THE 
SENSELESS  DESTRUCTION  OF  AIRCRAFT  IN  FLIGHT;  THIS  GENERALLY,  BUT 
CLEARLY  NOT  ALWAYS,  DUE  TO  EXPLOSIVE  DEVICES  BROUGHT  ON  BOARD 
AIRCRAFT  IN  CARRY-ON  AND  CHECKED  BAGGAGE. 

RECALLING  INTERPOL’S  TERRORISM  STATISTICS  INDICATING  BOMBINGS  TO 
BE  THE  MODUS  OPERANDI  IN  35  PERCENT  OF  1995  INCIDENTS,  AND  OUR 
INDUSTRY’S  RECORD;  I  WOULD  BELIEVE  THIS  TO  BE  A  VERY  MUCH  ONGOING 
THREAT  IN  THE  YEARS  TO  COME.  THEREFORE,  WE  LOOK  WITH  PARTICULAR 
INTEREST  AT  INCORPORATION  INTO  AIRCRAFT  DESIGN  THE  MEASURES  WHICH 
FOCUS  MOST  DIRECTLY  AT  VULNERABILITY  PERSPECTIVES  ASSOCIATED 
WITH  INFLIGHT  INTERNAL  EXPLOSIONS.  HOWEVER,  AS  OUR  INDUSTRY  DOES 
FACE  OTHER  THREATS,  AS  WELL,  WE  MUST  BROADEN  OUR  CONCERN  TO 
INCLUDE  VARIOUS  OTHER  DEFENSIVE  MEASURES  IN  THE  OVERALL  FIELD  OF 
INCORPORATION  OF  SECURITY  INTO  AIRCRAFT  DESIGN,  OR  “ISAD”. 

IFALPA  SUGGESTS  THAT  THE  DEVELOPING  AIRCRAFT  TYPES  BE  EQUIPPED 
WITH  SUITABLE  CARGO  HOLD  BOMB  PROOFING  MODIFICATIONS  WHICH 
PROVIDE  PROTECTION  TO  ESSENTIAL  CONTROLS  AND  HYDRAULIC  LINES.  WE 
STRONGLY  ENDORSE  THE  AIRCRAFT  AND  CONTAINER  HARDENING 
PROGRAMS  OF  THE  FAA.  WHILE  THE  AIRCRAFT  HARDENING  PROGRAM  HOLDS 
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CONSIDERABLE  PROMISE,  ECONOMICS  DICTATE  THAT  THE  MAJORITY  OF 
SUCH  MEASURES  WILL  BE  INCORPORATED  INTO  FUTURE  AIRCRAFT  AND 
POSSIBLY  CERTAIN  AIRCRAFT  FLYING  INTO  THE  HIGHER  RISK  THEATRES, 
RATHER  THAN  RETROFITTING  EXISTING  FLEETS  OF  AIRCRAFT.  THESE 
MEASURES  ARE  THE  TYPICAL  VULNERABILITY  REDUCTION  TECHNIQUES, 

SUCH  AS  PROTECTION  OF  CRITICAL  STRUCTURE,  COMPONENTS,  AND 
SYSTEMS,  BOTH  THROUGH  HARDENING  AND  INCREASED  REDUNDANCY. 

A  SENSIBLE  APPROACH,  WHICH  SEEMS  TO  BE  OF  CONSIDERABLY  LESS 
ECONOMIC  AND  OPERATIONAL  IMPACT,  IS  THE  HARDENING  OF  BAGGAGE  / 
CARGO  HOLDS  OR  THE  HARDENING  OF  BAGGAGE  CONTAINERS.  TESTS  HAVE 
BEEN  RECENTLY  CONDUCTED  USING  SURPLUSED  AIRFRAMES,  BOTH  HERE 
AND  IN  THE  UNITED  KINGDOM.  SEVERAL  PROTECTIVE  MATERIALS  WERE 
LAYERED  ONTO  THE  WALLS  OF  CARGO  HOLDS  WITH  RESULTANT 
CONSIDERABLE  MITIGATION  OF  THE  DESTRUCTIVE  EFFECTS  OF  THE  TEST 
EXPLOSIVES.  HARulNED  CONTAINERS  OF'  THE  “LD-3"  TYPE,  COMMONLY  USED 
IN  WIDE-BODIED  AIRCRAFT,  WERE  TESTED.  THESE  HARDENED  CONTAINERS 
WERE  QUITE  EFFECTIVE.  THERE  NEED  BE  SOME  FURTHER  IMPROVEMENTS  IN 
THE  DOOR  MECHANISMS,  HOWEVER,  FOR  OPERATIONAL  REASONS.  SMALLER 
SIZED  CONTAINERS  FOR  NARROW-BODIED  AIRCRAFT  ARE  BEING  DESIGNED  AT 
THE  PRESENT  TIME.  IT  IS  EXPECTED  THAT  BY  THE  END  OF  THE  YEAR  THERE 
WILL  BE  20  TO  40  HARDENED  CONTAINERS  BEING  OPERATIONALLY  TESTED  ON 
BOARD  THE  AIRCRAFT  OF  US  AIRLINES.  WE  WOULD  ENVISION  THAT 
EVENTUALLY  ONE  OR  TWO  HARDENED  CONTAINERS  WILL  BE  DEPLOYED  ON 
MANY  AIRCRAFT  THE  WORLD  OVER.  THE  REAL  VALUE  OF  THE  CONTAINERS  IS 
THAT,  DUE  TO  THEIR  CAPABILITY  OF  WITHSTANDING  A  MODEST  EXPLOSIVE 
CHARGE,  WHEN  IN  COMBINATION  WITH  THE  USE  OF  EXPLOSIVE  DETECTION 
EQUIPMENT,  THE  MINIMUM  QUANTITY  OF  EXPLOSIVE  NECESSARY  TO  BE 
DETECTED  IS  RAISED  TO  A  SIZE  THAT  PERMITS  OPERATION  OF  THE  EXPLOSIVE 
DETECTION  EQUIPMENT  AT  A  FAIRLY  HIGH  THROUGHPUT  OF  BAGS  WHILE 
ENJOYING  A  LOW  FALSE  ALARM  RATE.  THIS  MAKES  IT  OPERATIONALLY 
FEASIBLE  TO  ACCOMPLISH  “100  PER  CENT”  DEPARTURE  BAG  CHECKING 


ON  A  PERSONAL  NOTE,  IN  VIEW  OF  THE  BACKGROUND  OF  MANY  OF  YOU  HERE 
TODAY,  I  SHOULD  LIKE  TAKE  THE  LIBERTY  ONCE  AGAIN,  AS  I  DID  FOUR  YEARS 

AGO,  TO  DIGRESS  A  MOMENT  FROM  MY  PRESENTATION  , . TO  SPEAK 

WITH  YOU  NOT  AS  A  REPRESENTATIVE  OF  IFALPA  .  BUT  AS  PETER  REISS;  THE 
PERSON.  THESE  REMARKS  ARE  BEING  DELIVERED  TO  YOU  TODAY  BY  ONE 
WHO  PERSONALLY  FLEW  MAC  CONTRACT  AND  CRAF  FLIGHTS  OVER  A  PERIOD 
OF  27  YEARS,  IN  SUPPORT  OF  THE  EFFORTS  IN  SOUTHEAST  ASIA,  EUROPE, 
AND  THE  PERSIAN  GULF.  I  WOULD  LIKE  FURTHER  TO  SHARE  WITH  YOU  A 
MATTER  OF  DEEP  PERSONAL  SIGNIFICANCE  TO  ME  IN  MY  31  YEARS  OF 
FLYING  HEAVY  TRANSPORT  AIRCRAFT,  THE  MOST  EMOTIONALLY  AND 
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SPIRITUALLY  REWARDING  MOMENTS  OF  MY  CAREER,  WERE  THE  CRAF  FLIGHTS 
BRINGING  OUR  PERSONNEL  HOME  FROM  SAUDI  ARABIA  IN  EARLY  1991.  I 
SHALL  ALWAYS  FEEL  A  QUIET  AND  INTENSE  PRIDE.  NOW,  BACK  TO  MY 
PRESENTATION . 


I  WILL  BRIEFLY  TOUCH  UPON  OTHER  VULNERABILITY  REDUCTION 
CONSIDERATIONS  THAT  IFALPA  RECOMMENDS:  THE  DEVELOPMENT  OF 
IMPROVED  SMOKE/FIRE  WARNING  DEVICES  AND  EXTINGUISHING  EQUIPMENT 
IN  THE  CARGO  HOLDS;  DIRECTION  OF  AIR-FLOW  AWAY  FROM  THE  COCKPIT 
AREA;  AND  DESIGN  FOR  EASE  OF  SEARCH  /  INHIBITION  OF  CONCEALMENT. 
THESE  CONSIDERATIONS  ARE  UNDER  STUDY  BY  THE  ISAD  WORKING  GROUP 
AT  THE  INTERNATIONAL  CIVIL  AVIATION  ORGANIZATION,  AND  WILL  LIKELY  BE 
INCORPORATED  INTO  THE  APPROPRIATE  ANNEXES  IN  THE  NEAR  FUTURE. 

WHEN  VULNERABI'  !TY  REDUCTION  CONSIDERATIONS  LEAD  TO 
RECOMMENDED  MODIFICATIONS  TO  THE  AIRCRAFT  ITSELF,  WE  MUST 
ALSO  ADDRESS  POSSIBLE  RESULTANT  COST  TO  THE  MANUFACTURER,  AND, 
SUBSEQUENTLY  TO  THE  OWNER  AND  OPERATOR;  AND  THE  POTENTIAL  IMPACT 
ON  THE  OPERATION  OF  THE  AIRCRAFT’S  SYSTEMS  THEMSELVES.  LET  US 
LOOK  AT  THE  AFTERMATH  OF  THE  EXPLOSION  OF  TWA  800.  WHILE  I  HAVE  NO 
PARTICULAR  JUDGMENT  REGARDING,  OR  SUGGESTION  AS  TO  THE 
APPROPRIATENESS  OF,  THE  URGENT  RECOMMENDATIONS  EARLIER  THIS  YEAR 
OF  THE  NATIONAL  TRANSPORTATION  SAFETY  BOARD,  I  SEE  MANY  POTENTIAL 
IMPACTS  THEREFROM.  I  AM  SPECIFICALLY  REFERENCING,  AMONGST  OTHERS, 
THE  CARRIAGE  OF  EXTRA  FUEL,  REDUCED  USE  AND  MOVING  OF  AIR 
CONDITIONING  PACKS,  AND  MOVING  OF  THE  FUEL  PUMPS. 

THE  COST  OF  RETROFIT  -  SEVERAL  MILLIONS  OF  DOLLARS  EACH  FOR  THE 
1,000+  BOEING  747’S  IN  SERVICE  TODAY  MUST  BE  CAREFULLY  CONSIDERED. 
IFALPA  SUGGESTS  THAT  THE  COST  OF  CARRIAGE  OF  NON-USABLE  FUEL  IN 
THE  CENTER  TANK  -  IN  THE  ECONOMICS  ARENA  -  IN  REDUCED  USEFUL  LOAD 
CARRYING  CAPABILITY,  AND  THE  INCREASE  IN  THE  LIKELIHOOD  OF  FIRE  IN  A 
CATASTROPHIC  LANDING  ACCIDENT  MUST  BE  VERY  CAREFULLY  STUDIED 
BEFORE  ANY  APPLICATION  OF  A  MANDATED  POLICY  IS  EVEN  CONSIDERED. 

LET  ALONE  SUGGESTED  OR  PROMOTED.  I  WOULD  MOST  FERVENTLY  HOPE 
THAT  ANY  SUCH  VULNERABILITY  REDUCTION  MEASURES  ARE  BASED  UPON 
VERY  HARD  EVIDENCE  THAT  SUCH  MEASURES  ARE  NECESSARY  AND 
APPROPRIATE  FOR  THE  TRUE  RISK  INVOLVED,  AND  ARE  NOT  A  RESPONSE  TO 
OTHER  PRESSURES.  IN  OUR  STUDIED  OPINION,  THE  CAUSE  OF  THE 
CATASTROPHIC  INFLIGHT  BREAK-UP  OF  TWA  800  IS  STILL  A  VERY  MUCH 
UNSOLVED  QUESTION. 

MAY  I  SUGGEST  THAT  THE  MORE  RECENT  RECOMMENDATIONS  OF  THE 
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NATIONAL  TRANSPORTATION  SAFETY  BOARD  TO  REDUCE  THE  EXPLOSIVE 
POTENTIAL  OF  THE  FUEL  ULLAGE,  OR  VAPOR,  WOULD  SEEM  TO  BE  LESS 
INTRUSIVE  INTO  THE  OPERATIONAL  AND  ECONOMIC  ARENAS.  AMONG  THESE 
ARE  INTRODUCTION  OF  COOLED  FUEL  INTO  THE  CENTER  TANK,  INERTING  THE 
TANK  WITH  A  NON-REACTIVE  GAS,  AND  INSULATION  OF  THE  TANK  TO  PROTECT 
IT  FROM  THE  HEAT  GENERATED  BY  THE  AIR  CONDITIONING  UNITS.  HOWEVER, 
EVEN  THESE  MEASURES  EACH  APPEAR  TO  CREATE  THEIR  OWN  OPERATIONAL 
PROBLEMS  (FOR  EXAMPLE,  THE  OBIGGS  SYSTEM  ON  THE  C-17).  FURTHER, 
THERE  ARE  SAFETY-DIMINISHING  IMPACTS  AS  WELL  TIED  TO  EMPLOYMENT  OF 
THESE  PROPOSALS. 

WHILE  OUR  SYMPOSIUM  IS  FOCUSED  ON  THE  VULNERABILITY  PERSPECTIVE, 
PLEASE  BEAR  WITH  ME  WHILE  I  DIGRESS  TO  A  SUSCEPTIBILITY  MATTER  FOR 
A  MOMENT,  AS  I  WISH  TO  MENTION  TO  YOU  A  KEY  ASPECT  OF  THE  NEW 
SECURITY  PARADIGM  THAT  IS  BEING  DEVELOPED:  PROFILING.  WE  STRONGLY 
SUPPORT  THE  CONCEPT  OF  “PROFILING"  OF  PASSENGERS.  OUR 
RESPONSES  MUST  BE  THREAT-DRIVEN  AND  SPECIFIC.  IN  1995,  MEMBER 
AIRLINES  OF  THE  INTERNATIONAL  AIR  TRANSPORT  ASSOCIATION  CARRIED  1.3 
BILLION  PASSENGERS  WORLDWIDE.  THERE  WERE  FIVE  HIJACKINGS  THAT 
INVOLVED  REAL  WEAPONS.  TEN  PERPETUATORS  WERE  INVOLVED.  TEN  OUT 
OF  1.3  BILLION. ...  THE  RESOURCES  AVAILABLE  TO  OUR  INDUSTRY  ARE  NOT 
LIMITLESS.  THEREFORE,  WE  MUST  TARGET  PRIMARILY  ON  THE  HIGHER  THREAT 
AREAS  OR  INDIVIDUALS,  BE  IT  LOOKING  FOR  WEAPONS  OR  BE  IT  LOOKING  FOR 
EXPLOSIVES  -  INCLUDING  THOSE  IN  PASSENGER  BAGGAGE,  CARRY-ON  OR 
CHECKED. 

WE  SHARE  WITH  LAW  ENFORCEMENT  AGENCIES  THE  WORLD  OVER  THE 
CONCEPT  THAT  INTERVENTION  BY  GROUND  FORCES  DURING  A 
HIJACKING  IS  ONLY  A  LAST  RESORT,  ONLY  TO  BE  PERFORMED  WHEN  ALL  ELSE 
HAS  FAILED.  WE  FURTHER  RECOGNIZE  THE  UNIQUE  TACTICAL  NATURE  OF 
THIS  ACTION,  AND  THE  CRITICAL  NEED  OF  HAVING  ONLY  HIGHLY  AND 
SPECIALLY  TRAINED  TEAMS  PERFORMING  THIS  SURGICAL  AND  EXTREMELY 
CHALLENGING  OPERATION.  MAY  I  SUGGEST  THAT  HISTORY  HAS  SHOWN  THE 
POTENTIAL  COST  AMPLIFICATION  OF  AN  INCIDENT  SHOULD  AN  INTERVENTION 
BY  GROUND  FORCES  GO  AWRY.  ON  THE  OTHER  HAND,  I  SHOULD  LIKE  TO  NOTE 
THAT  THERE  ARE  EXCELLENT  EXAMPLES  OF  THE  VALUE  AND  CAPABILITY  OF  A 
HIGHLY  TRAINED  AND  QUALIFIED  SPECIAL  OPERATIONS  GROUP.  THE  UNITED 
STATES  IS  TRULY  TO  BE  COMMENDED  FOR  THEIR  ATTENTION  TO  ALL  THE 
DETAILS  AND  EXPENDITURES  NECESSARY  TO  MAINTAIN  IN  TOP  OPERATIONAL 
CONDITION  THE  UNITS  AVAILABLE  FOR  AN  INTERNAL  INTERVENTION,  AND 
THOSE  UNITS  AVAILABLE  FOR  AN  EXTRA-TERRITORIAL  OPERATION  (HERE  I 
SPECIFICALLY  REFERENCE  GEOGRAPHIC  EXTRATERRITORIALITY.  AS  A  UNITED 
STATES  REGISTERED  AIRCRAFT  IS,  REGARDLESS  OF  LOCATION,  UNITED 
STATES  TERRITORY). 
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I  SHOULD  LIKE  TO  SHARE  WITH  YOU  AN  INCIDENT  THAT  TOOK  PLACE  DURING 
THIS  PAST  YEAR.  ITS  NARRATION,  WHILE  AMUSING,  IS  FURTHERMORE  A  GOOD 
ILLUSTRATION  OF  HOW  THE  SYSTEM  WORKS. 

AN  AIRCRAFT  OPERATING  INTO  AN  EASTERN  UNITED  STATES  CITY  WAS 
DELAYED  FOR  FORTY  MINUTES  BY  WEATHER,  RESULTING  IN  A  PLANNED 
TWENTY-MINUTE  OUTBOUND  DELAY.  SHORTLY  BEFORE  THIS  PLANNED 
DEPARTURE,  A  PASSENGER  SEATED  IN  THE  MAIN  CABIN  OF  THE  AIRCRAFT, 
WHO  WAS  DISTURBED  BY  THIS  DELAY  MADE  THE  REMARK  TO  AN  ATTRACTIVE 
YOUNG  WOMAN  SEATED  NEXT  TO  HIM,  “WELL,  I  GUESS  THAT  THEY  HAVEN’T 
FOUND  MY  BOMB  YET”.  SHE,  BEING  QUITE  STARTLED,  RATHER  THAN  BEING 
IMPRESSED  AS  HE  HAD  HOPED,  ASKED  HIM  WHAT  HE  HAD  JUST  SAID.  HE 
REPEATED  “WELL,  I  GUESS  THAT  THEY  HAVEN’T  FOUND  MY  BOMB  YET”.  THIS 
TIME  OTHERS  HEARD  HIS  REMARK.  SHE  WAS  QUITE  DISTURBED,  AND 
INQUIRED  OF  HIM  AGAIN,  WHEREUPON  HE  JUST  SAT  THERE  IN  HIS  HARVARD 
BUSINESS  SCHOOL  SWEATSHIRT  AND  SMIRKED.  SHE  THEN  WENT  TO  A 
FLIGHT  ATTENDANT,  AND  -  WE  ALL  KNOW  HOW  THE  THE  CHAIN  OF  COMMAND 
WORKS  -  THE  CAPTAIN  WAS  ADVISED. 

WELL,  IT  SO  HAPPENS  THAT  THE  COPILOT  IS  A  MEMBER  OF  THE  SECURITY 
COMMITTEE  FOR  THAT  AIRLINE  AND  IS  A  FORMER  POLICE  OFFICER.  WITHIN 
SEVERAL  MINUTES  HE  AND  OUR  SELF-STYLED  COMEDIAN  WERE  IN  THE 
TERMINAL  DISCUSSING  THE  MATTER.  A  MOMENT  LATER,  OUR  SUSPECT  WAS 
IN  CONTINUED  DISCUSSION  WITH  AN  FBI  AGENT  AND  TWO  6’  6”  LOCAL  POLICE 
OFFICERS;  AND  A  BOMB  DOG.  HE  FLATLY  AND  VEHEMENTLY  DENIED  HIS 
STATEMENTS;  THEY  USUALLY  DO!  HIS  FIVE  ACCOMPANYING  PASSENGERS, 
INCLUDING  HIS  BOSS  AND  HIS  BOSS’  BOSS  WHO  WERE  IN  THE  FIRST  CLASS 
CABIN  OF  THE  AIRCRAFT,  SOON  JOINED  THEM  WITH  ALL  OF  THEIR  BAGGAGE. 

THE  DOG’S  PART  OF  THE  CONVERSATION  IS  THAT  HE  ALERTED  WITH  GREAT 
INTEREST  AND  ENTHUS'ASM  ON  A  SET  OF  GOLF  CLUBS.  IN  MORE  WAYS  THAN 
ONE,  THESE  WERE  NOT  JUST  ANY  ORDINARY  SET  OF  GOLF  CLUBS,  SO  IT 

TURNED  OUT.  WE  WILL  GET  TO  THAT . THE  GOLF  CLUBS  SOON  WENT  ON 

THEIR  LAST  RIDE:  TO  A  REMOTE  AREA  OF  THE  AIRPORT.  THERE,  THEY  WERE 
ASSISTED  BY  A  1/2  POUND  DISRUPTER  CHARGE  -  INTO  THE  GREAT  BEYOND. 

WELL,  IT  TURNED  OUT  THAT  THESE  SIX  PASSENGERS  WERE  ON  THEIR  WAY  TO 
A  MAJOR  GOLF  TOURNAMENT  IN  PHOENIX  -  1,200  MILES  DISTANT.  THE  FLIGHT 
WAS  DELAYED  FOR  AN  HOUR  AND  A  HALF,  THUS  PREVENTING  THE  AIRCRAFT 
FROM  GETTING  TO  PHOENIX  IN  TIME  TO  FLY  A  FULL  LOAD  OF  186  PASSENGERS 
BACK  TO  THE  EASTERN  CITY  THAT  NIGHT.  THIS  MEANT  THAT  IN  ADDITION  TO 
BEING  CHARGED  WITH  A  FEDERAL  CRIMES  ABOARD  AIRCRAFT  STATUTE,  OUR 
“WISE  MAN”  HAD  TO  REIMBURSE  THE  AIRLINE  FOR  ALL  ASSOCIATED  LOST 
REVENUE  -  PLACING  THOSE  186  PASSENGERS  ONTO  OTHER  AIRLINES,  ETC  - 
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LIKELY  WELL  OVER  $20,000. 


OH.  YES...  YOU  WONDER  ABOUT  THOSE  GOLF  CLUBS?  WELL,  THEY  WERE  A 
$6,000  SET  OF  GRAPHITE  CLUBS...  AND  WHOSE  WERE  THEY?  YES,  YOU 
GUESSED  IT  -  THEY  BELONGED  TO  HIS  BOSS. 

I  HAVE  OFTEN  WONDERED  IF,  WHEN  HE  EXPLAINED  TO  HIS  WIFE  HOW  THEY 
WERE  SUDDENLY  $20,000  IN  DEBT,  HE  WAS  WITHOUT  A  JOB  AND  FACING 
CONVICTION  FOR  A  FEDERAL  CRIME,  SHE  COMMENTED  TO  HIM  ABOUT  HOW 
SHE  HAD  SOMETIMES  WONDERED  JUST  HOW  LONG  IT  WOULD  BE  BEFORE  HIS 
BIG  MOUTH  WOULD  GET  HIM  INTO  SERIOUS  TROUBLE...  .  MAY  I  SUGGEST  THAT 
THAT  YOUNG  MAN  HAS  NOW  A  MUCH  CLEARER  AWARENESS  OF  HOW  THE 
SYSTEM  WORKS! 

I  WILL  MENTION  BRIEFLY  TWO  AREAS  OF  REAL  CONCERN  TO  OUR  SECURITY 
COMMITTEE. 

FIRST,  ILLICIT  CROSS-BORDER  MOVEMENT  OF  NUCLEAR  MATERIAL 
AND  OTHER  RADIOACTIVE  SOURCES  MAY  I  SUGGEST  THAT  THIS 
TRAFFICKING  AND  ALL  OF  ITS  POTENTIAL  RAMIFICATIONS  MAY  WELL  BECOME 
ONE  OF  THE  GREATEST  THREAT  AREAS  BY  WHICH  WE  ARE  CONFRONTED.  MAY 
WE  FURTHER  SUGGEST  THAT  THE  SCOPE  AND  THE  DEGREE  OF  THREAT  IS 
INCREASING  AT  AN  EXPONENTIAL  RATE,  ESPECIALLY  EMANATING  FROM  THE 
FORMER  SOVIET  UNION  AND  CERTAIN  AREAS  IN  EASTERN  EUROPE. 

THE  INTERNATIONAL  ATOMIC  ENERGY  AGENCY  ESTABLISHED  A  GROUP  OF 
SPECIALISTS  FROM  A  NUMBER  OF  INTERNATIONAL  ORGANISATIONS, 

INCLUDING  INTERPOL,  EUROPOL,  EURATOM,  IFALPA.  THE  WORLD  CUSTOMS 
ORGANISATION,  IATA,  AND  SEVERAL  OTHERS  TO  DEVELOP 
RECOMMENDATIONS  AND  ASSIST  IN  THEIR  IMPLEMENTATION  IN  THE  AREA  OF 
CONTROL  OF  ILLICIT  CROSS-BORDER  TRANSFER  OF  NUCLEAR  AND 
RADIOACTIVE  MATERIALS.  OUR  RECOMMENDATIONS  WERE  PRESENTED,  WITH 
THE  FULL  BACKING  OF  THE  IAEA,  TO  THE  “GROUP  OF  8”  AT  THE  MOSCOW 
SUMMIT  THIS  YEAR. 

THE  TOTAL  LACK  OF  AWARENESS  OF  SOME  OF  THE  SMUGGLERS  AS  REGARDS 
THE  DANGERS  OF  SIMPLY  CARRYING  THESE  MATERIALS  CANCELS  OUT  EVEN 
THE  BASIC  INSTINCTS  OF  SELF-SURVIVAL.  THE  DANGERS  TO  OUR 
PASSENGERS,  CREWS,  AND  INDUSTRY  RANGE  FROM  DISASTROUS  PERSONAL 
EXPOSURE  TO  A  CONTAMINATED  $160,000,000  AIRCRAFT  BEING  PLACED  OUT 
OF  SERVICE  FOR  1 5  YEARS.  MAY  I  ASK  EACH  OF  YOU  HERE  TODAY  TO 
IMAGINE,  FOR  A  MOMENT,  IF  YOU  WOULD,  A  TRAVELER  WITH  A  KILO  OF  CESIUM- 
137  IN  HIS  BRIEFCASE  SEATED  NEXT  TO  YOU  ON  AN  EIGHT-HOUR  FLIGHT 
.. ..IMAGINE  THE  DISASTROUS  CONSEQUENCES  TO  YOU.... 
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WE  FORECAST  AS  WELL  A  THREAT  OF  ONBOARD  PRESENCE  -  AS  A  WEAPON  - 
OF  CHEMICAL  AND  BIOLOGICAL  MATERIALS.  AS  A  REPRESENTATIVE  OF  THE 
JAPANESE  DELEGATION  SAID  LAST  AUTUMN  AT  THE  INTERPOL  TERRORISM 
SYMPOSIUM,  “IT  IS  POSSIBLE  FOR  EVERY  MOTIVATED  TERRORIST  TO  USE 
THOSE  KIND  OF  WEAPONS  NOWADAYS".  AS  THE  CHIEF  OF  THE  COUNTER¬ 
TERRORIST  UNIT  AT  INTERPOL  (AN  AMERICAN  FBI  AGENT  SECUNDED 
THERETO)  SAID,  “THE  ISSUE  OF  WMD  IS  NOT  A  MATTER  OF  ‘IF',  BUT  ‘WHEN’  AND 
‘HOW  OFTEN’  “. 

WE  ARE  CONVINCED  THAT  THE  SOPHISTICATION  OF  CERTAIN  OF  THOSE  WHOM 
ARE  DEDICATED  TO  ACTS  AGAINST  OUR  INDUSTRY,  BE  THEY  OF  STRAIGHT 
CRIMINAL  NATURE,  OR  BE  THEY  ACTS  OF  TERRORISM,  WILL  INCREASE 
DRAMATICALLY.  THE  LEVEL  OF  EFFECTIVENESS  OF  OUR  MEASURES  MUST  BE 
DEVELOPED  TO  A  DEGREE  THAT  WILL  CONTINUALLY  EXCEED  THE  CAPABILITY 
OF  “THE  BEST  AND  THE  BRIGHTEST"  OF  THIS  TRADE. 

IT  IS  ESSENTIAL  THAT  WE  HAVE  A  COORDINATED  PROACTIVE  APPROACH  IF  WE 
ARE  TO  SUCCEED  IN  MANAGING  THE  THREAT.  THIS  REQUIRES  INFORMATION 
AND  INTELLIGENCE. 

“STRENGTH  THROUGH  INDUSTRY  AND  TECHNOLOGY” .  ON 

THURSDAY  I  WAS  AT  OUR  LAYOVER  HOTEL  IN  TOKYO,  READING  THE  JAPAN 
TIMES.  I  HAD  JUST  SPENT  SEVERAL  HOURS  WORKING  ON  THIS 
PRESENTATION.  A  THOUGHT  CAME  TO  MIND  AS  I  READ  ABOUT  CHUCK 
YEAGER’S  FLIGHT  OF  CELEBRATION,  IN  THE  F-15,  OF  THE  50TH  ANNIVERSARY 
OF  HIS  BREAKING  THE  SOUND  BARRIER  IN  THE  X-1 .  YOU  ALL  HAVE  COME  A 
LONG  WAY  DURING  THESE  LAST  FIFTY  YEARS  IN  AIRCRAFT  VULNERABILITY 
REDUCTION  TECHNOLOGY.  WE  ON  THE  COMMERCIAL  SIDE  HAVE  CERTAINLY 
BENEFITED  THEREFROM,  AS  HAS  THEREBY  EVERY  SINGLE  PASSENGER  WHO 
RIDES  ON  OUR  JET  TRANSPORTS  TODAY.  SOMETIMES  THERE  SEEM  TO  BE 
LOTS  OF  FOLKS  WHO  FORGET  THAT . 

I  SHOULD  LIKE  TO  DIGRESS  AT  THIS  POINT  FROM  THE  VULNERABILITY 
PERSPECTIVE  TO  ONE  ESPECIALLY  IMPORTANT  AREA  OF  AVIATION  SAFETY....  A 
FUNDAMENTAL  THAT  ENTERS  INTO  EVERY  SINGLE  ASPECT  OF  AVIATION 
SECURITY  AND,  IN  FACT,  EVERY  ASPECT  OF  TRANSPORTATION  SAFETY.  THAT 
IS  TEAMWORK.  BE  IT  ON  THE  FLIGHT  DECK  -  AS  PART  OF  THE  DOMAIN  OF 
CREW  RESOURCE  MANAGEMENT,  OR  IN  THE  STUDY  AND  IMPLEMENTATION  OF 
ISSUES  OF  THREAT  RESPONSE  -  LONG  TERM  SUCH  AS  VULNERABILITY 
REDUCTION  TECHNOLOGY  AND  ITS  IMPLEMENTATION;  OR  SHORT  TERM  - 
TEAMWORK  IS  ESSENTIAL.  BASED  IN  PART  ON  OBSERVATION  DURING  MY  30 
YEARS  OF  WORK  IN  AVIATION  SECURITY,  I  AM  CONVINCED  THAT  IT  IS  THROUGH 
THE  INCREASED  JOINT  INDUSTRY-GOVERNMENT  EFFORTS. 
DOMESTICALLY  AND  INTERNATIONALLY,  THAT  THE  IMPACT  OF  THIS 
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ESSENTIAL  COMPONENT  IS  MAXIMIZED.  IT  IS  THROUGH  OUR  COMING 
TOGETHER  AT  SYMPOSIUMS  SUCH  AS  THIS  THAT  _WE  FORM  THE  NETWORKS 
THAT  FACILITATE  OUR  UNDERLYING  SUCCESS  AND  OUR  OVERALL  PROGRESS. 
I  CANNOT  STRESS  TOO  STRONGLY  THE  IMPORTANCE  OF  TEAMWORK  -  OF 
TEAMWORK  AND  COOPERATION  IN  THE  LONG-TERM  SUCCESS  OF 
TRANSPORTATION  SAFETY  AND  SECURITY.  I  WISH  TO  CITE  THE  COMMENTS  OF 
OUR  KEYNOTE  SPEAKER,  JOHN  GOGLIA  FROM  THE  NATIONAL 
TRANSPORTATION  SAFETY  BOARD,  THIS  MORNING  REGARDING  HUMAN 
FACTORS  AS  AN  EXCELLENT  REVIEW  OF  THE  INTERRELATIONS  BETWEEN 
HUMAN  FACTORS  AND  COMMUNICATION  IN  AVIATION  SAFETY  IN  OUR  GLOBAL 
AVIATION  FAMILY. 

IN  CLOSING,  I  MAKE  ONE  REQUEST  ON  BEHALF  OF  IFALPA.  OUR  REQUEST  IS 
THAT  YOU  LOOK  UPON  US  AS  A  RESOURCE.  A  RESOURCE  TO  BE  CALLED 
UPON  AS  PART  OF  THE  TEAM.  WE  HAVE  FOR  MANY  YEARS  SERVED ,  AND  WE 
CONTINUE  TO  SERVE,  AS  A  PART  OF  THE  GOVERNMENT  AND  INDUSTR  T 
AVIATION  SECURITY  TEAM. 

AGAIN,  WE  APPRECIATE  YOUR  INCLUSION  OF  US  IN  YOUR  SYMPOSIUM,  AND  I 
INVITE  YOUR  QUESTIONS  THIS  AFTERNOON  DURING  OUR  PANEL  DISCUSSION. 

LADIES  AND  GENTLEMEN,  THANK  YOU  FOR  YOUR  KIND  ATTENTION. 
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Vulnerability 
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Air  Warrior  Equipment 
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Survivability  Sympost 


Rear  Admiral  J.  M.  Johnson 
Head,  Aviation  Plans  and  Require 


Survivability  Integration  is  Necessary 
to  Obtain  Optimal  Solution 
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Survivability  Today 
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Perspectives  on  Operational 
Requirements  and 
Vulnerability  Reduction 

ADPA  Symposium,  Naval  Postgraduate  School 
October  21,  1997 


Major  General  Fred  McCorkle,  USMC 

CG,  3D  MAW 
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With  Apologies  to  the 
Schoolhouse . 


■Susceptibility  is  an  operational 
construct 

Vulnerability  is  a  design  and 
programmatic  construct 
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Fiscal  Realities 


In  programmatic,  material  terms, 
Vulnerability  reduction  is  a 
function  of  design  and  retrofit 
dollars  available 
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Backdrop  Assumptions 


The  Marine  Corps  Aviation 
Combat  Element  (ACE)  of  the  near 
term  will  be  characterized  by  a 
"mature"  assault  support  fleet  of 
legacy  aircraft  that  will  still  be 
operating  2010-2020 
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Backdrop  Assumptions 


Threat  proliferation  trends  will 
continue,  with  anti-aircraft 
weaponry  expanding  throughout 
Bthe  littoral  battlespace 
Any  weapon,  anti-air  or  not,  can 
kill  USMC  aircraft,  given  the  right 
conditions 

Waterfowl  have  at  least  7  recorded  kills 
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Backdrop  Assumptions 


The  past,  current,  and  future 
threats  are  ones  which  capitalize 
on  some  of  our  historical 
vulnerabilities: 

► IR  hotspots 
►  Aircrew  safety 
-  Intelligence  gaps 
Cultural  Character  (TRAP,  NEO,  etc) 
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Operational  Realities 


The  pace  of  technological  change 
has  far  exceeded  that  of 
vulnerability  reduction 

The  MV-22  of  2020  will  continue  to  be 
vulnerable  in  some  of  the  same  ways  as 
the  CH-46  of  1965 
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Operational  Realities  (cont'd) 


Predicted  operational  tempos  do 
not  offer  any  relief  from  being 
exposed  to  increasing  numbers  of 
threats,  especially  in  the  urban 
environment 
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Operational  Perspectives 


For  our  present  aircraft, 
vulnerability  quotients  will 
outpace  reduction  efforts  as 
weapons  become  both  more 
prevalent  and  accurate 
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Operational  Perspective 


Those  factors  which  highlight 
present  aircraft  vulnerability  are 
largely  immutable: 

*  Cannot  select  operating  environment 

*  Cannot  preclude  all  weapon  engagements 

*  Cannot  protect  against  every  weapon 
Multi-mission  optimization  has  its  costs... 
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Design  and  Programmatics 


From  the  aspect  of  aircraft  design 
and  program  management, 
actions  which  effect  fleet  aircraft 
vulnerability  are  addressable  from 
this  point  forward. 

Retrofit  is  not  a  salable  option 
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Present  Efforts 


■  F/A-18  C/D  Hornet 

•  Fuel  System 

►  Fuel  isolation  from  engines 

►  Fuel  tank  hydraulic  ram 

-  Self-sealing  feed  tanks  and  engine  feed  lines 

►  Void  filler  foam  for  dry  by  fire  protection  below  fuselage  tanks 

►  Wing  tank  unexpended  fuel  explosion  protection 

•  Flight  Control  System 

-  Redundant  separated  hydraulics 

►  Rip  stop  actuators,  Hydraulic  reservoir  level  sensing 

►  Redundant  flight  control  conputers 
.  Mechanical  backup 

•  Propulsion  System 

-  Fire  detection  and  extinguishing  system 

►  Blade  containment  measures 

■  No  improvements  planned 
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Present  Efforts  (cont'd) 


AV-8B  (Day  and  Reman  A/C) 

No  improvements  planned 

£A-6B 

Blk  89A  Halon  fire  extinguisher 

KC-130F/R/T 

No  improvements  planned 


Present  Efforts  (cont'd) 


CH-46 

•  Self-sealing  fuel  tanks 

B  No  improvements  planned 
CH-53D/E 

•  Self-sealing  fuel  tanks 

B  No  improvements  planned 

UH-1 N/4BN//AH-1 W/4BW 

No  improvements  planned 
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Future  Efforts 


■  MV-22 

•Systems  Protection 

.  Armor 

► System  Isolation 

►  System  Redundancy 
»  System  Separation 

•  Ballistic  tolerance 

►  Engine  Fire  Suppression 

►  Nitrogen  Inerted  Fuel  Tanks 
»  Self-sealing  Fuel  Bladders 

-  Hydraulic  Ram  Protection 

►  Dry  Bay  Fire  Protection 

-  Composite  Structure 

►  Capability  vs.  23mm  API  (threshold  =  12.7  mm) 


147 


Future  Efforts  (cont'd) 


KC-130J 

Reticulated  Wing  Tank  Foam 

Approximately  80%  improvement  in  vulnerability  reduction 

Data  bus  wiring 

Reduces  wiring  bundling  throughout  aircraft 


Conclusion 


"Future  design  goals  make 
appropriate  and  overdue 
reductions  in  aircraft 
vulnerabilities 

"Current  aircraft  will  continue  to 
present  challenges  for 
vulnerability  reduction  efforts 


Backup  slides 
follow . 
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The  Reality  of  USMC 
Operations 


•Operational  Maneuver  from  the  Sea 
•  USMC  must  be  "Ready  on  Arrival" 
•The  Battlespace  may  be  Immature 
•Close  proximity  to  the  threat 
•Threats  cover  all  spectra  (RF,  IR, 
Visual,  Acoustic) 
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Immature  Battlefield 


■  Intelligence  capabilities  not  fully 
deployed 

■  Dominant  battlefield  knowledge 
not  fully  developed 


Expeditionary  Operations 


■Aircraft 

•  Maintainable 

•  Repairable 
•Small  logistical  tail 

•  High  sortie  rate 

*  minimum  maintenance 

•  Multi  mission  profile 


■  Mission 

•  Dynamic,  fluid  threat 

•  Proximity  to  threat 

►  Min.  reaction  time 

►  Low  J/S  strength 

*  EOB  inaccuracies 

►  Exposure  time 

•  24  hour  operations 
•All  spectrum  threats 
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The  Future 


■Fixed  Wing  Attk  AV-8B+F-18C/D  =  JSF 
Support  EA-6B+C-130  =  EA  +  C- 

■  130J 

■Rotary  Wing  Lift  CH-46+CH-53  =  V-22 

Rotary  Wing  Attk  UH-1N+AH-1W  =  4BN  +  4BW  = 

JRA 


Factors  Affecting  Investment 
Strategy 

■  Lack  of  independent  resources 

■  Unique  requirements 
■Small  force 
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Air  Force  Perspective 
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Offensive  Posture  Enhances  Combat  Effectiveness 


Fundamental  Lessons  of  Air  Power 


xn 

xn 

O 

u 

p 

u 

a 

QJ 

s 

o* 

0) 

Sn 

a j 

u 


I 

*5; 

»s> 

i 

a 

£ 


T3 

G 

cd 


O 

Z 

03 

<D 

£ 

o 

rC 

c 

o 

•  »-h 

W 

a 


OX) 

X 

OX) 

S3 

S3 

£ 

5h 

P 


Ph 

s  0 

0> 

a 

2  1 

S3  ' 

§ 

u 

•  pa* 

u 

0 

£ 

s- 

k. 

£ 

0 

n 

•  ^■4 

u 

•3 

s 

QJ 

•  pN 

Q* 

P 

>. 

S3 

*Si 

3 

C fl 

O 

u 

53 

• 

■§ 

Sts 

s* 

v* 

> 

£ 

• 

*S3 

Si 

•A* 

153 

s> 

£ 


.If 


-Si 

I 


s> 

si 

S3 

si 


*§ 

•b 

S3 

S3 

<2 

*S  5 

«  m2 

§  & 

3  ^ 
-2  fee 

a*  si 

2  ^ 

$  £ 

'h*  ^ 

V. 

SJ  V 

>5  ^ 

Q  si 

5  S3 


<D 

Ph 

>» 

0> 

i-H 

o 

<D 

GO 

<D 

C/3 

G 
p0> 
C— i 
<1) 

Q 


Fundamental  Lessons  Underscore  Our  Approach  to  Survivability 
—  Freedom  from  Attack  Allows  Freedom  to  Attack 
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Our  National  Environment  Demands 
Continued  Improvement  in  Effectiveness 
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Provides  the  Framework  for  JV2010  and  Dictates 
Control  of  the  Air  as  an  Essential  State 


Enabling  and  Leveraging  Air  Dominance 


The  Synergy  of  Enabling  Technologies  Provide  the  Best  Path 
to  Enhance  Both  Aircraft  and  Total  Force  Survivability 
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Stealth ’s  Contribution  to  Mission 
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Stealth  Provides  an  Effective,  Survivable  System 
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1.8  days  to  sustained  capability 

'tealth  —  High  Leverage  Enabler  for  Most  Challenging  T 
Releases  Bulk  of  Force  for  Other  Priority  Targets 

SOURCE:  USAF  COST  AND  PLANNING  FACTORS,  AFI 65-503,  CONSTANT  1994  DOLLARS 


Level  of  Stealth  is  Driven  by  Aircraft 
„  Mission  and  Situational  Threat  < 


891 


Operational  Targets:  Airfields/Shelters,  Railroads/Bridges,  Combat  Support  Nodes,  Naval  Ports,  SAMs 
Tactical  Targets:  Tanks,  APCs,  Artillery,  Aircraft/helos  in  open,  Ships  and  Vessels 

JFC  Requires  Balance  of  Dominant  Capability  and  High  I 
Operations  Tempo  to  Service  the  Full-Spectrum  of  Targets  1 


Precision  —  Redefining  Effectiveness 
While  Minimizing  Risk 


6  9  T 


Gulf  War  _ 

Precision  Effectiveness  —  During  Gulf  War,  more  targets  were 
attacked  in  24  hours  than  8th  AF  attacked  in  all  of 1 942  andl  943 


Information  Fusion 
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Fused  Information  provides  a  Transparent  Battlespace  —  Improves 
Situational  Awareness  and  Enables  Rapid  Exploitation 


Fused  Information  —  Delivering 
Unprecedented  Situational  Awareness 


Pilot  is  Battle  Manager  vs  Sensor  Integrator 


Z  LI 


Reduces  Detection  to  Destruction  from  Hours  to  Minutes 


ZLl 


F-15  F-22  F-16  JSF 

Approximately  20-40%  Less  Warriors  at  Risk 


The  Synergy  of  Enabling  Technologies 
Answers  Challenges  to  JV2010  < 


The  Payoffs 


The  Freedom  From  Attack . 


£  /.  I 


.  Reduces  Enemy  Offensive  Sorties  by  45  % 


.  the  Freedom  To  Attack 


9  LI 


.  Increases  Friendly  Kills  of  Enemy 

Equipment 


and  Enables  an  Early  Halt 


.  Reduces  Enemy  WMD  Facilities  by  an 

additional  76  % 


This  Approach  Reduces  Total  Force 


2  LI 


Rapid  Response,  Early  Halt,  and  Decisive  Victory 
.With  Minimal  Loss  ofjjfe  and  Collateml  Damage 


Aircraft  Survivability 

A  Look  into  the  Crystal  Ball 
(A  Composite  Sketch) 


October  21, 1997 


James  F.  O’Bryon 

Deputy  Director 
Operational  Test  and  Evaluation 
Office  of  the  Secretary  of  Defense 
Room  1C730,  Pentagon 
(703)  614-5408 

E-Mail:  jobryon@dote.osd.mil 
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“Many  factors  influence  aircraft  survivability. 
Detection  and  tracking,  susceptibility, 
performance  and  agility,  and  types  of  weapons 
used. 

All  play  a  role,  as  do  an  aviator’s  skills 
and  the  effectiveness  of  his  tactics.  But  even  if  all 
our  susceptibility  reduction  techniques  work 
perfectly,  the  odds  are  we  will  still  take  some 
hits. 

Therefore,  minimizing  physical 
vulnerability  is  an  equally  important  factor  in 

the  overall  survivability  equation.” 


Rear  Admiral  John  F.  Calvert 
PEO  Tactical  A/C 
Navy  Assistant  Secretary,  RDA 
A/C  Survivability  magazine 
September  1990,  p.  6 
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Misperceptions  About 
Aircraft  Survivability 


1.  Reducing  aircraft  vulnerability  always  has 

significant  weight  penalties. 

2.  Susceptibility  reduction  does  not  constitute  the 

addition  of  significant  weight. 
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Misperceptions  About 
Aircraft  Vulnerability 

(continued) 


3.  Vulnerability  reduction  and  susceptibility 

reduction  are  mutually  exclusive. 

4.  Aircraft  always  will  be  flying  when  subjected  to 

threats. 
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Misperceptions  About 
Aircraft  Vulnerability 

(continued) 


5.  We  won’t  get  hit. 

6.  Vulnerability  reduction  applies  only  to  damage 

caused  by  combat. 
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Misperceptions  About 
Aircraft  Vulnerability 

(continued) 


7.  There  is  no  need  to  quantify  vulnerability  is 

one  sufficiently  can  quantify  susceptibility. 

8.  An  aircraft  hit  is  an  aircraft  killed. 
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10  TRENDS  AND 
CONCERNS  IMPACTING 

THE 

AIRCRAFT 

SURVIVABILITY 

COMMUNITY 
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TRENDS  AND  CONCERNS  IMPACTING 

THE 

AIRCRAFT  SURVIVABILITY 
COMMUNITY 


GROWING  USE  OF 
NON-METALLIC  MATERIALS 


O  INADEQUATE  DATA  BASE 

O  DANGERS  OF  EXTRAPOLATION  FROM 
METALLIC  DATA  BASE  AND  FROM  LOW 
VELOCITY  IMPACTS  ON  COMPOSITES 

O  DIFFICULTIES  IN  DIAGNOSING 

VULNERABILITY  (E.G.  DELAMINATION) 

O  ADDED  COST  OF  MANUFACTURE 

O  ADDED  COST  OF  MAINTENANCE 

O  ADDED  SUSCEPTIBILITY  TO  RF  AND 
LIGHTNING  DAMAGE 
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TRENDS  AND  CONCERNS  IMPACTING 

THE 

AIRCRAFT  SURVIVABILITY 
COMMUNITY 


INCREASING  IJSF  OF  COST  /  BFNFFIT 


O  UNDER-ESTIMATION  OF  BENEFITS 

O  VALUE  OF  HUMAN  LIVES  SAVED  OFTEN 
NOT  INCLUDED 

O  NO  EXISTING  METHOD  IS  ABLE  TO 
CAPTURE  THE  VERY  REAL  BUT  NON- 
QUANTIFIABLE  BENEFITS 
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Quantifying  the 
Value  of  a  Life 


The  Department  of  Transportation  uses  several 
methods: 

1 .  Lifetime  earning  power  lost  to  the  family. 

2.  Economic  loss  to  the  organization  from 

which  the  individual  came. 

3.  Anticipated  amount  of  money  an  insurance 

company  would  award  if  life  was  lost. 

4.  Punitive  costs  expected  to  be  paid  by  an 

agency  found  at  fault  for  loss  of  life. 
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VULNERABILITY  T&E  PAYOFFS 

INSIGHTS  &  FIXES  YIELD  NOT  ONLY 
REDUCED  ATTRITION  IN  COMBAT 

ALSO  YIELDS 

O  MORE  DURABLE  ROBUST  A/C  IN  PEACETIME 

O  LONGER  A/C  LIFESPAN 

O  HIGHER  TOLERANCE  TO  FOD,  BIRDSTRIKES 

O  HIGH  TOLERANCE  TO  HARD  LANDINGS 

O  INSIGHTS  WHICH  CAN  RESULT  IN  BETTER 
TACTICS  (DIFFERENT  COMBAT  EXPOSURES) 

O  DESIGN  LESSONS  FOR  APPLICATION  TO 
FUTURE  AIRCRAFT 

O  BATTLE  DAMAGE  AND  REPAIR  INSIGHTS, 
PRACTICE  AND  PROCEDURES 

O  ADDED  DISCIPLINE  TO  THE  T&E  PROCESS 

O  DATA  TO  REVISE  /  CORRECT  /  CALIBRATE  M&S 
TOOLS  FOR  BOTH  FUTURE  DESIGNS  & 
DIAGNOSTICS  &  BETTER  DIAGNOSTIC 
TOOLS  FOR  ASSESSMENT  OF  PAST  A/C 
FAILURES 
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TRENDS  AND  CONCERNS  IMPACTING 

THE 

AIRCRAFT  SURVIVABILITY 
COMMUNITY 

GROWING  RELIANCE  ON  STEALTH 

O  LESS  TRADE  SPACE  LEFT  FOR 
VULNERABILITY  REDUCTION 

O  MANY  STEALTH  MATERIALS  NOT 
OPTIMIZED  FOR  STRENGTH 

O  ADDED  WEIGHT  TO  ACHIEVE  LO 

O  POTENTIAL  TECHNOLOGICAL 
BREAKTHROUGHS  IN  TARGET 
ACQUISITION  COULD  NEGATE  STEALTH 

O  LITTLE  TO  NO  PAYOFF  IN  PEACETIME 

O  HEAVY  MAINTENANCE  BURDEN 

O  SMALL  HITS  -  LARGE  RCS  GROWTH 

o  COSTLY  INVESTMENTS  IN  STEALTH 
LEAVING  LESS  $  LEFT  FOR 
VULNERABILITY  REDUCTION  TRADES 
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Stealth 

According  to  Kasich 

(continued) 


•  Stealth  is  not  invulnerability  or  invisibility.  It  is 

management  of  the  aircraft’s  signature. 

•  Just  as  there  is  no  “free  lunch,”  Stealth  is  a 

compromise. 

•  The  stealthier  an  aircraft,  the  more  likely  it  is  to 

degrade  other  desirable  combat  characteristics,  such 
as  speed,  maneuverability  or  payload. 

•  Stealth  is  inherently  expensive  and  difficult  to 

maintain;  the  coating  degrades  with  each  mission. 
Stealth  is  not  an  all  aspect  cloak  of  invisibility.  It  is 
optimized  to  defeat  radars  ahead  of  the  aircraft,  but 
is  less  effective  from  other  angles.” 


John  R.  Kasich 
Washington  Post 
July  19,  1995 
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Stealth 

According  to  Kasich 


(continued) 


Historically,  weight  growth/cost  growth  has  been 
attributed  unjustifiably  to  primarily 
vulnerability  reduction. 

“The  risk/benefit  trade  space  for  stealth  also 
has  very  significant  procurement  cost,  weight, 
performance  and  maintenance  penalties,  which 
must  be  integral  to  any  cost/benefit  study.” 
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TRENDS  AND  CONCERNS  IMPACTING 

THE 

AIRCRAFT  SURVIVABILITY 
COMMUNITY 


GROWTU  O FJ  PEACETIM E  VULNERABILITY' 

LOSSES 


O  BIRD  STRIKES 
O  LIGHTNING  STRIKES 
O  WIRE  STRIKES 
O  FOD 

O  TRAINING  ACCIDENTS 
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TRENDS  AND  CONCERNS  IMPACTING 

THE 

AIRCRAFT  SURVIVABILITY 
COMMUNITY 


HFAVIFR  RELIANCE  ON  MANEUVER 


O  GROWING  G-LOADING  (BOTH  +  AND  -)  ON 
AIRFRAME 

O  GROWING  G-LOADING  (BOTH  +  AND  -)  ON 
PILOT(S)  (GLOC  /  ALOC  IMPLICATIONS) 
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TRENDS  AND  CONCERNS  IMPACTING 

THE 

AIRCRAFT  SURVIVABILITY 
COMMUNITY 


CHAINING  NIATIJRF 

OF  THF  THREAT 


O  NOT  JUST  BIGGER,  BETTER,  FASTER 

O  FROM  BULLETS  TO  SMART  BULLETS 

O  FROM  MISSILES  TO  SMART  MISSILES 

O  FROM  BALLISTIC  TOWARD  DIRECTED  ENERGY 

O  EMERGENCE  OF  "NICHE  WARFARE" 

O  SOFT  KILLS  BECOMING  AS  CRITICAL  AS  HARD 

KILLS 
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Scope  of  LFT&E  Threat 
Considerations 


Small  Arms 

Fragmenting  Projectiles 
Shaped  Charges 
Kinetic  Energy  Rods 
Self-Forging  Frag 
High  Explosives 


Lasers 

Incendiaries 

Blast/Fuel  Air  Explosives 
Charged  Particle  Beams 
High  Powered  Microwaves 


Nuclear 

Thermonuclear 

Chemical 

Biological 


Covered  By  Live  Fire  Requirements 

< — 

Not  Covered 
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*  New  systems  are  becoming  more  complex: 


*  Testing  needs  to  rethink  what  it  is  trying  to  find  out: 

Live  Fire  Test  design  must  account  for  the  “soft”  kills 

and 

partial  kills 

not  Live  Fire  and  Brimstone 
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TRENDS  AND  CONCERNS  IMPACTING 

THE 

AIRCRAFT  SURVIVABILITY 
COMMUNITY 


TRFNIR  TOWARD  MORF  INTERMAI I Y 

STOWED  MUNITIONS 


O  INCREASES  STEALTH  AND  RANGE 

O  SIGNIFICANTLY  INCREASES  A/C 
VULNERABILITY 

O  A/C  MUST  BE  TREATED  AS  TOTAL  SYSTEM  - 
INCLUDING  STOWED  MUNITIONS 
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TRENDS  AND  CONCERNS  IMPACTING 

THE 

AIRCRAFT  SURVIVABILITY 
COMMUNITY 


HEAVIER  RELIANCE  ON  M&S 


O  MODELS  STILL  INADEQUATE  TO  PREDICT 
VULNERABILITY,  AT  THE  COMPONENT 
LEVEL,  LET  ALONE  AT  THE  FULL-UP 
SYSTEM-LEVEL 

O  INADEQUATE  ARCHITECTURES  TO  YIELD 
MEASURABLE  AND  COMPARABLE  OUTPUT 
METRICS 

O  SOME  PHENOMENA  NOT  MODELED 
ADEQUATELY  OR  AT  ALL  (FOLLOW- 
THROUGH  FIRE,  ULLAGE,  HYRDO  RAM, 
SPALL,  RICOCHET,  RF.  ETC) 


200 


DOT&E/LFT&E  SUPPORT 

TO  M&S 


1.  LFT&E  /  JLF 

o  SHORTER  TERM 
o  WEAPON  /  PLATFORM  SPECIFIC 
o  TEST  DRIVEN  w/  PRE-SHOT  PREDICTIONS 
o  PRIMARILY  FROM  EMPIRICALLY  BASED 

MODELS 

2.  TILV 

o  MID-TERM 

o  MORE  TARGET  GENERIC  (A/C,  SHIPS,  COMBAT 

VEHICLES) 

o  TEST  &  MODEL  DRIVEN 


3.  DOT&E/LFT&E  /  POE  ASCI  MOA 

o  LONGER  TERM 
o  MOST  TARGET  INDEPENDENT 
o  "PHYSICS-BASED  MODELS"  VALIDATED  BY 
REALISTIC  LFT&E  TEST  OPPORTUNITIES 
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TRENDS  AND  CONCERNS  IMPACTING 

THE 

AIRCRAFT  SURVIVABILITY 
COMMUNITY 


MOVE  TOWARD  COMMERCIAL 

SPECS  AND  STANDARDS 


O  LESSONS  BEHIND  EXTANT  MILSPECS  NOT 
OFTEN  AVAILABLE  OR  HEEDED 

O  POTENTIAL  LIABILITY  TO  A/C 

MANUFACTURERS  IF  ATTRIBUTABLE  LOSS 
OF  A/C  AND/OR  LIFE  TO  ’  POOR"  DESIGN 

O  PEACETIME  MENTALITY  PERVADING  A/C 
MINDSET 
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TRENDS  AND  CONCERNS  IMPACTING 

THE 

AIRCRAFT  SURVIVABILITY 
COMMUNITY 


MOVF  TOWARD  MARGINALLY  STABI  E  / 

AERQDYNAMICAUL  v  UNSTABLE  AIRCRAFT 


O  IMPACT  OF  DAMAGE  TO  CONTROL 
SURFACES 

O  EFFECT  OF  DAMAGE  /  DEGRADATION  TO 
FLIGHT  CONTROLS  &  SOFTWARE, 
POSSIBLE  LOSS  OF  CONTROL 

O  AI  IMPLICATIONS 
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Objectives  of  LFT&E 


•  To  enable  the  Secretary  to  make  informed  system 

acquisition  decisions 

•To  gain  insights  into  potential  design  flaws  so  that 
they  can  be  corrected  before  entering  full-rate 
production 

•  To  ensure  that  knowledge  of  system  survivability 

and  lethality  is  based  on  realistic  testing 
of  the  system  configured  for  combat  against 
expected  threats 

•  Primary  emphasis  on  testing  vulnerability  with 

respect  to  potential  user  casualties 

•  Individual  Soldiers 

•  Armor  Crews 

•  Aircraft  Crews 

•  Ship  Crews 

•  Tactical  Vehicle  Crews 
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This  Page  intentionally 
Left  Blank 


NEW  LFT&E  AND  TRAINING 
INITIATIVE  (LFT&TI) 


O  ADDRESSES  SECDEF’S  T&E  THRUSTS 

O  SUPPORT  FROM  CONGRESS  INITIATED  IN  FY97 
AND  GROWING 

O  TAKING  LFT&E  RESULTS,  TESTS, 

OPPORTUNITIES,  INSIGHTS  AND  PROVIDE 
THESE  TO  THE  TRAINING  COMMUNITY  FOR 
THEIR  BENEFIT 

O  TAKING  TRAINING  OPPORTUNITIES  TO 
GATHER  FURTHER  LFT&E  INSIGHTS 
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LFT  Payoffs 


K— ... 


•  Provides  the  data  necessary  to  make  fully  informed 
acquisition  decisions 

•  Provides  insights  into  vulnerability  and/or  lethality  of 
systems  in  development 

•  Adds  discipline  to  the  test  design  process 

•  Provides  battle  damage  and  repair  insights  for  training 

•  Provides  spare  parts  stockage  level  data 

•  Teaches  tactics  lessons 

•  Feeds  operational  test  assessment 

•  Provides  necessary  input  to  overall  survivability 
analysis 

•  Provides  basis  for  PK’s  for  force-on-force  models 
(procurement  mix) 

•  Leverages  future  weapons  designs 

•  Produces  data  used  as  inputs  to  training  simulators 

It  saves  lives! 
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Change 


Change  is  inevitable, 
except  from  a  vending  machine. 


OUTLOOK 


A  PERSONAL  VIEW 


"PEACE  15  THE  TIME 
BET WEE/v)  CONFLICT 
WHE/v)  OAT 1005  TAKE 
TIME  TO  RELOAD" 
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PRE  1974  DESIGN  PHILOSOPHIES 
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materials,  manufacturing  processes  and  design  concepts. 


INTEGRAL  STRUCTURE 

INTEGRATING  PARTS  CAN  SIGNIFICANTLY  REDUCE  ASSEMBLY 
COSTS 


PAST  EXPERIENCE  SHOWS  THAT  BUILT-UP  STRUCTURE  IS 
INHERENTLY  MORE  DAMAGE  TOLERANT  THAN  ITS  INTEGRAL 
COUNTERPART 


873 


FAA97003 

10/9/97 


6ZZ 


LU  3 
I  ^ 
H  ^ 

q  q 

HI  “i 

H  2 
co  5 
z  < 

O  LU 

s  y= 

LU  _l 

Q  LU 
CO  Li. 

<  < 

I  CO 

LU  LU 

O  x 


CO 

LU 

X 

O 


£ 

o 

LL 

Q 

LU 


LU 

0 

< 


- 2u 

H  <f  Q  ^ 
CL  —  s>  > 

oy  |o: 

q  0£  _  LL 
<  HI  -J  CO 


£  2 
Z  ° 

g  ° 

s  a 

UJ  Z 
0£  < 
D  Z 

o  O 

jy  <n 

Cl  uj 

LU  Q 
O  I— 

z 
< 

$KL 
LU  O 


O 

I- 

LU 

o 

< 

< 

D 


£ 

< 

>- 

o' 

< 

i— 


CL 

CO 


2 


LU 


O 

H 

O 

<  O' 
CL  UJ 

2  LL 

"  < 


=  LU 


go 

«i  < 

9  (0 

-  2 
fc  h  W 

S|t 

VSS 

H  N» 
U.  Q  UJ 

§21 
£  <  O 

-  I  UJ 
<  O  CL 
h  LU  7 

goo 

O  Z  ^ 
2“ 


O  CO 
CL  LU 

HI 

I  Q 
H  -J 

2g 


ty  >- 


CO 
5  LU 

t  < 

CO  5 


5  H 


LU 
CL 

el 


LU 

CO 

Q 

LU 

CO 

< 

LU 

QC 

O 


< 

Q 

G 

LU 

Z 


CL 

Z 


< 

o 

LL 

z 

0 

CO 


LU 

CO 

LU 

QC 

CL 


±  3 


w 

s  o: 

LU  3 
H  CO 
CO  CO 
>-  LU 
CO  ££ 

LU  CL 

<  | 

CO  O 

O  z 
o'  o 

LU  o 
<  LU 


CO 

o 

o 

h~ 

O 

3 

LL 


CHALLENGES  WITH  RESPECT  TO  IMPLEMENTION  OF 
NEW  DAMAGE  TOLERANT  DESIGNS 
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Improving  Human  Survivability  In 
Aircraft  Through  Crashworthiness 
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I’ll  review  some  recent/ongoing  crashworthy  technology  activities 
at  LaRC  that  directly  support  Human  Survivability,  and 
Make  a  few  Concluding  Remarks. 


Aviation  Safety  Research 
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process. 


NASA  Aviation  Safety  Investment  Strategy  Team  (ASIST) 
Process 
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Space  Transportation  Technology  Executive  Council  on  April  23rd. 

From  the  5  areas,  3  investmnent  areas  were  identified  :  Accident  Prevention, 
Accident  Mitigation  (Human  Survivability),  &  System-Wide  Monitoring). 


NASA’s  New  Aviation  Safety  Research  Program 
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This  process  led  to  the  3  potential  investment  areas  addressing  safety  issues 
which  can  help  to  realize  the  national  goal. 

NASA  alone  or  any  other  organization  alone  can  not  achieve  the  goal.  It  will  take 
the  combined  efforts  of  many  organizations. 


Aviation  Safety  Program  Office 
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Accident  Mitigation  (Human  Survivability). 

Cross-cutting  representation  of  Rotorcraft/GA  and  Flight  Testing  are  included 
across  all  investment  areas. 


Human  Survivability  Team  (In  Time) 

Attendance 


OPZ 


the  participants  with  time. 

The  numbers  grew  over  the  course  of  the  four  workshops. 


number  ot  ratal  accidents  ( with  survivors)  to  no  latanties  status, 
aircraft  accident  rate  will  not  necessarily  be  reduced  as  desired. 
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Human  Survivability  (HS) 

Prioritization  Of  Investment  Areas  Across 
The  Major  Four  Human  Survivability  Issues 
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findings  and  recommendations,  all  of  which  were  also  prioritized  by  the  entire 
ASIST  team. 

Evacuation  and  Occupant  Protection  are  not  currently  included  in  the  program 
due  to  funding  limitations  and  priority. 
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The  next  Crashworthiness  workshop  is  planned  for  December 
8  -  9, 1997  at  Langley  Research  Center. 


HUMAN  SURVIVABILITY  (accident  mitigation) 

THROUGH  SYSTEM  CRASHWORTHINESS 

AN  ELEMENT  OF  THE  AIRCRAFT  SAFETY  PROGRAM  (ASP) 


9*?Z 


G 

© 

© 

OX) 


G 

© 

•  P4 

CD 

CD 

< 


f© 

© 

> 

•pN 

u 

G 

to 

G 

© 


S 

K 


© 

-+^ 

c 

© 

g 

^© 

© 

© 

I /3 

C/3 

C/3 

© 

© 


© 

O 

F© 

C/3 

© 

© 

u 


© 

© 

*© 

© 

© 

> 

© 

© 

©H 

© 

u 

•PN 

© 

© 

G 

© 

|  1 
u  ^ 
ox)  22 


F© 
© 

s  § 

©I 
©I 

£  <! 


C/3 

g 

© 

c/3 


© 
g 
g 

*  1/5 

.5  * 

OX) 

r\  2™ 

X/l  p 
©  © 
p©  £ 

H  5 


© 

Sh 

© 


.© 

© 

to 

«E 

© 

Sh 

© 

© 

to 

£ 

£ 

© 

© 

F© 


© 

© 

O 

C/3 

C/3 

© 

© 


Sh 

© 

£ 

p© 

C/3 

© 

u 

u 

© 

5 

Cm 

© 

C/3 

© 

© 

© 

< 


© 

to 

T3 

© 

© 


Occupant  Analysis  &  Modeling 

All  these  activities  are  aimed  at  enhancing  Human  Survivability 
through  Crashworthiness  Technology. 
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Parallel  to  CID  was  beginning  of  focus  on  composite  structures  for  aircraft. 

In  the  90 ’s  we  have  tested  composite  aircraft  under  crash  loads  to  build  database 
and  now  the  00’s  hold  the  new  Aircraft  Safety  Program  efforts. 


IMPACT  DYNAMICS  RESEARCH 
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Best  Available  Copy 


DYNAMICS  FACILITIES 
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707  cross-section  size. 

Various  static  test  equipment  is  use  in  the  lab  for  components  testing,  and  an  Impact 
Tower  is  available  for  dynamics  component  tests. 

Data  acquisition  and  analysis  is  done  on  a  computer  based  system. 


HUMAN  SURVIVABILITY  REQUIREMENTS 
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•  Minimize  the  post  crash  hazards 
The  next  few  slides  illustrate  some  of  our  efforts 
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EA  beam  concepts. 

A  down-select  will  be  made  for  incorporation  into  a  full-scale  aircraft  for  evaluation 
of  crash  performance. 


COMPOSITE  AIRCRAFT  CRASH  TEST  PROVIDES  IMPORTANT 
DATA  ON  STRUCTURE  AND  OCCUPANT  LOADS 
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Failure  was  fracturing  of  all  the  composite  frames  along  the  bottom  of  the  aircraft 
floor  region.  No  failure  occurred  in  the  metal  floor  beams  beneath  the  seat  rails. 
Pilot  spinal  load  in  non-EA  seat  was  over  3000  lbf  while  the  co-pilot  in  a  JAARS  EA 
concept  was  slightly  over  the  Part  23  requirement  of  1500  lbf. 


Composite  Aircraft 
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A  secondary  test  with  longitudinal  inputs  at  42  fps,  10  degree  yaw  into  an  dirt 
embankment  for  airbag  technology  assessment. 
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Other  standard  seats  from  a  manufacturer  a  second  EA  seat  concept  were  on-board. 
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AGATE’s  ID&M  has  a  major  crashworthiness  element  in  that  program. 


Excellent  Occupant  Crash  Protection  Achieved  With  an  Energy 
Absorbing  Concept  Developed  for  “Thrush”  Aircraft  Seat 
(Ayres  Corporation’s  Agriculture  Airplane) 
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G’s  on  occupant  were  about  15  g’s,  but  more  importantly  the  compressive  spinal 
load  at  32.  5  fps  did  not  exceed  1500  lbf  Part  23  requirement  at  a  lower  impact  velocity  ! 
Technology  information  has  been  transfered  to  Ayres  Corporation  for  whatever  they 
wish  to  do  with  approach  and  concept. 


STRUCTURAL  CRASH  DYNAMICS 
MODELING  AND  SIMULATION 
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will  be  analyzed. 

Follow-on  efforts  will  be  to  crash  test  an  ACAP  article  (similar  to  one  shown),  compare 
the  analytical/experimental  results  and  make  recommendations  for  code  improvements 
as  necessary. 
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Systems  Approach  to  Crashworthiness 

Elements  that  Comprise  the  System 
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Thus  (bottom  right),  a  systematic  approach  of  identifying  the  system,  the  scenarios,  the 
response  of  the  elements  of  the  system,  and  using  combined  test  and  analysis  methods  are 
necessary  to  develop  solutions  and  standards  for  designing  crashworthy  technology  into 
aircraft  for  Enhancing  Human  Survivability. 
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Aviation  Safety  Investment  Strategy  Team 

(ASIST) 


Aviation  System-wide  Monitoring,  Modeling  &  Simulation 
Human  Survivability 


NASA  Aviation  Safety  Investment  Strategy  Team  (ASIST) 
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in  Absolute  Fatality  Numbers,  The  Converse  Is  Not  Necessarily  True. 

Fatality  Reduction  Is  Highly  Desirable,  But  Unless  Significant  “No 
Fatality”  Accidents  Results  The  Fatal  Accident  Rate  May  Be  Larger  Than 
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Human  Survivability  (HS) 

Challenges/Objective  of  HS  Investments 

Challenges/Objective  of  Fire  Investment : 


All  the  Challenges/Objectives  Are  Aimed  At  Mitigation/Reduction  of  Fatalities 
and  Serious  Injuries  In  Current  As  Well  As  New  Aircraft  Configurations. 
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WATER  SPRAY  SYSTEM  DEVELOPMENT  AND  EVALUATION 
FOR  ENHANCED  POSTCRASH  FIRE  SURVIVABILITY  AND  IN-FLIGHT 
PROTECTION  IN  CARGO  COMPARTMENTS 

Timothy  R.  Marker 
Constantine  P.  Sarkos 
Richard  G.  Hill 

Fire  Safety  Section 
Federal  Aviation  Administration 
William  J.  Hughes  Technical  Center 
Building  287  AAR-422 
Atlantic  City  International  Airport,  NJ  08405 
USA 


1.  SUMMARY 

This  paper  describes  full-scale  fire  tests  conducted  by 
the  Federal  Aviation  Administration  (FAA)  to  evaluate 
and  optimize  water  spray  systems  in  two  specific 
aircraft  fire  safety  applications.  The  first  application 
was  an  onboard  cabin  water  spray  system  designed  to 
improve  postcrash  fire  survivability.  The  goal  is  to 
suppress  a  severe  cabin  fire,  initiated  by  a  large  external 
fuel  fire,  in  order  to  improve  the  available  time  for 
passenger  evacuation.  The  second  application  was  a 
cargo  compartment  water  spray  system  for  the  purpose 
of  suppressing  and  controlling  in-flight  cargo/luggage 
fires.  In  this  case,  the  water  spray  system  must  suppress 
and  contain  a  worst-case,  deep-seated  fire  for  as  long  as 
180  minutes,  or  until  an  airplane  can  be  safely  landed. 

2.  INTRODUCTION 

Although  aircraft  crashes  occur  very  infrequently,  the 
life  safety  consequences  of  a  postcrash  fire  are  of  great 
concern  because  of  the  potential  involvment  of  large 
quantities  of  flammable  jet  fuel,  the  use  of  polmeric 
materials  to  line  ..nd  furnish  the  cabin,  and  the 
problems  associated  with  ,v,e  rapid  evacuation  of  a 
large  number  of  passengers  from  a  confined 
environment. 

The  goal  of  enhanced  postcrash  fire  survivability  is 
twofold:  (1)  additional  available  time  for  passenger 
evacuation  by  reducing  cabin  fire  hazards,  and  (2) 
greater 

evacuation  rate  of  passengers.  Improvements  in 
postcrash  fire  safety  attaining  these  goals  have  been 
achieved  in  recent  years  (Sarkos,  1989),  including  the 
installation  of 

more  fire  resistant  cabin  materials,  based  on  stringent 
fire  test  standards  developed  and  adopted  by  FAA.  The 
FAA  has  strived  to  develop  further  improvements  in 
postcrash  fire  survivability  in  a  joint  program  with  the 
United  Kingdom  (U.K.)  Civil  Aviation  Authority  and 
Transport  Canada  to  develop  an  on-board  cabin  water 
spray  fire  suppression  system.  The  baseline  water  spray 
system  was  designed  in  the  U.K.  by  Safety  Aircraft  and 
Vehicles  Equipment,  Ltd.  (SAVE).  It  basically 
consisted  of  a  large 


number  of  small  nozzles,  mounted  throughout  the 
ceiling,  which  discharged  a  fine  water  spray  (mean 
droplet 

diameter  of  about  100  microns)  throughout  the  length 
of  the  cabin  for  a  period  of  3  minutes  (Whitfield,  et  al, 
1988). 

The  test  arrangement  for  the  cabin  water  spray  tests 
simulated  a  survivable  aircraft  crash  involving  fuselage 
exposure  to  an  external  fuel  fire.  The  fire  source  was  an 
8-by-10  foot  pan  of  burning  jet  fuel  which  had  been 
shown  previously  to  be  representative  of  the  thermal 
threat  created  by  a  large  fuel  spill  fire.  The  discussion 
in  this  paper  will  be  limited  to  a  typical  scenario 
comprised  of  a  fuel  fire  adjacent  to  an  opening 
(simulated  rupture)  in  the  test  fuselage  the  size  of  Type 
A  door  (76  by  42  inches).  A  variable  speed  exhaust  fan 
in  the  front  of  the  fuselage  created  a  draft  inside  the 
cabin,  allowing  the  degree  of  fuel  fire  penetration 
through  the  hole  and  the  resultant  severity  of  the  fire 
inside  the  cabin  to  be  varied.  Good  control  over  the  fuel 
fire  conditions  were  maintained  because  the  tests  we,  .■ 
conducted  inside  a  building,  assuring  test  repeatability. 
The  8-by-10  foot  pan  fire  tests  were  conducted  with 
both  a  narrow-body  fuselage  and  a  wide-body  fuselage. 
The  former  is  a  surplus  B-707  airplane  while  the  latter 
is  a  130-foot-long  hybrid  consisting  of  a  40-foot  DC-10 
section  married  to  a  90-foot  cylinder.  Similar  tests  with 
a  smaller  fuel  fire  were  conducted  in  a  Metroliner 
commuter  aircraft  test  article. 

Aircraft  cargo  compartments  are  protected  with  Halon 
1301  total  flooding  fire  suppression  systems.  Since  the 
production  of  halon  ceased  in  developed  countries  on 
January  1,  1994,  as  specified  by  an  international 
agreement  called  the  Montreal  Protocol,  the  future 
availability  of  halon  for  aviation  is  uncertain. 
Therefore,  the  FAA  has  a  program  to  evaluate 
replacement  and  alternative  agents/systems,  such  as 
water  spray,  in  cargo  compartment  and  other  aircraft 
applications  for  the  purpose  of  developing  certification 
criteria  for  those  agents  deemed  acceptable  (FAA, 
1993).  A  cargo  compartment  water  spray  system  could 
also  trade-off  the  weight  penalty  associated  with  a 
cabin  water  spray  system. 
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The  cargo  compartment  water  spray  tests  were 
conducted  in  the  lower  forward  compartment  of  the 
wide-body  test  article.  The  volume  of  the  cargo 
compartment  was  2300  cubic  feet  and  the  leakage  rate 
was  85  cubic  feet  per  minute,  or  one  air  change  every 
27  minutes. 

3.  EFFECTIVENESS  OF  CABIN  CONTINUOUS 
WATER  SPRAY  SYSTEM 

Narrow-Body  Test  Article.  A  plan  view  of  the 
narrow-body  test  article  is  shown  in  figure  1,  indicating 
the  fuel  pan  location,  continuous  (SAVE)  water  spray 
system  nozzle  arrangement  and  location  of 
instrumentation  and  cabin  materials.  The  water  spray 
system  consisted  of  120  nozzles  which  discharged  72 
gallons  of  water  over  a  period  of  3  minutes. 
Instrumentation  consisted  of  thermocouples,  smoke 
meters,  gas  analyzers,  gas  sampling  equipment, 
calorimeters,  and  photographic  and  video  cameras.  A 
24-foot-long  section  of  the  test  article,  centered  at  the 
external  fire  pan,  was  outfitted  with  5  rows  of 
passenger  seats,  ceiling  panels,  stowage  bins,  sidewalls, 
and  carpet.  All  materials  were  compliant  with  the 
current  FAA  fire  test  standards  (Sarkos,  1989).  A 
similar  test  setup  was  utilized  in  the  wide  body  tests 
described  later  in  the  paper. 

Initially,  a  zero  ambient  wind  condition  was  simulated 
by  not  operating  the  exhaust  fan.  With  the  absence  of 
flame  penetration  through  the  fuselage  opening,  the  fire 
exposure  of  cabin  materials  was  dominated  by  intense 
thermal  radiation.  The  results  of  the  zero  wind  tests, 
with  and  without  water  spray,  are  shown  in  figure  2. 
The  shaded  areas  in  this  and  subsequent  figures  show 
the  range  in  measurements  at  a  particular  fuselage 
station.  In  all  Cases,  the  highest  readings  were  at  the 
highest  locations,  and  the  readings  decreased  the  closer 
the  measurement  location  was  to  the  floor.  Temperature 
was  measured  at  1-foot  increments  fium  a  location  7 
feet  high  (slightly  below  'he  ceiling)  to  a  location  1  foot 
above  the  floor.  Smoke  was  measured  at  three  heights: 
5  feet,  6  inches;  3  feet,  6  inches;  and  1  foot,  6  inches. 
All  gas  measurements  were  at  5  feet,  6  inches  and  3 
feet,  6  inches. 

Figure  2  exhibits  a  rapid  rise  in  temperature  and  toxic 
gas  production  and  a  decrease  in  oxygen  concentration 
at  approximately  5  minutes  in  the  test  without  water 
spray.  This  behavior  indicates  the  development  of  a 
flashover  condition  at  5  minutes.  However,  when  water 
spray  was  used,  survivable  conditions  prevailed  for  the 
entire  7-minute  test  duration.  The  time  interval  of 
actual  water  spray  discharge  was  from  1 5  seconds  until 
approximately  195-200  seconds  into  the  test.  Therefore, 
in  addition  to  the  reduction  in  cabin  fire  hazards  during 
the  water  spray  discharge,  there  were  notable 
improvements  in  the  cabin  environment  after  the 
discharge  was  completed. 

Survival  time  was  calculated  from  the  measured 
hazards  by  employing  a  fractional  effective  dose  (FED) 


model  (Speitel,  1995).  It  assumes  that  the  effect  of  heat 
and  each  toxic  gas  on  incapacitation  is  additive  and  that 
the  increased  respiratory  rate  due  to  elevated  carbon 
dioxide  levels  is  manifested  by  enhanced  uptake  of 
other  gases.  The  FED  plot  in  figure  2  shows 
incapacitation  occurred  at  5  minutes  without  water 
spray  discharge,  corresponding  to  the  time  of  flashover. 
Discharge  of  water  spray  prevented  flashover  within 
the  7-minute  test  duration  and  maintained  a  survivable 
environment  within  that  increment  (FED<0.1  at  7 
minutes).  Therefore,  the  increase  in  survivability 
provided  by  water  spray  discharge  was  much  greater 
than  2  minutes. 

A  “moderate”  wind  scenario  was  devised,  by  operating 
the  exhaust  fan  to  induce  fuel  fire  flame  penetration 
through  the  fuselage  opening,  in  order  to  create  a  more 
severe  fire  threat  than  imposed  by  the  zero  wind 
condition.  Figure  3  shows  the  results  of  those  test  the 
profiles  are  quite  similar  to  i  j  zero  wind  test  (figure  2) 
but  are  transposed  earlier  in  time  by  about  2  minutes. 
Flashover  occurred  between  150  and  180  seconds 
without  water  spray.  With  water  spray,  flashover 
occurred  much  later  (about  300  seconds)  and  with  less 
intensity  (lower  temperature  rise  and  gas  production). 
The  FED  plot  shows  that  the  increase  in  survival  time 
was  21 5  seconds.  Figure  3  also  shows  that  water  spray 
is  highly  effective  in  removing  water  soluble  acid  gases 
such  as  hydrogen  fluoride. 

The  water  spray  system  was  also  evaluated  against  a 
“high”  wind  scenario.  In  this  case,  the  fuel  fire  flames 
penetrated  across  the  ceiling  practically  to  the  opposite 
side  of  the  cabin.  The  fire  was  so  severe  that  it 
overwhelmed  the  water  spray,  and  it  became  necessary 
to  terminate  the  test  after  only  60  seconds.  The  high 
wind  test  further  illustrated  that  the  benefits  of  fire 
safety  design  improvements  are  highly  dependent  upon 
the  fire  scenario,  and  for  some  very  severe  scenarios  it 
is  virtually  impossible  to  improve  survivability  by 
design  changes. 

Wide-Bodv  Test  Article.  In  the  wide-body  test  article, 
the  SAVE  system  consisted  of  324  nozzles,  arranged  in 
5  rows  along  the  length  of  the  fuselage.  A  quantity  of 
195  gallons  of  water  was  discharged  over  a  period  of  3 
minutes.  A  “moderate”  wind  condition,  causing  fuel 
fire  flame  penetration  through  the  fuselage  opening, 
was  utilized  to  evaluate  the  effectiveness  of  water  spray 
in  the  wide-body  test  article.  Figure  4  shows  the  result 
of  those  tests.  As  in  the  narrow-body  tests,  significant 
reduction  in  cabin  temperatures  and  toxic  gas  levels 
were  evidenced  during  the  water  spray  test.  Of  some 
concern  is  the  light  transmission  profiles  reflecting  the 
reduction  in  visibility  due  to  smoke.  For  more  than  half 
the  test  duration,  because  the  water  spray  tends  to  lower 
the  ceiling  smoke  layer,  there  is  a  greater  reduction  in 
light  transmission  while  the  water  is  being  discharged. 
Apparently,  the  amount  of  smoke  particulate  removal 
or  “washing  out”  by  the  water  spray  is  more  than  offset 
by  the  lowering  of  the  smoke  layer.  Later,  however,  the 
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reduction  in  light  transmission  with  an  unabated  fire 
becomes  more  significant. 

The  FED  curve  indicates  a  loss  of  survivability  at  215 
seconds  without  the  water  spray  system.  Examination 
of  the  temperature  and  gas  levels,  particularly  oxygen 
concentration  (not  shown),  indicates  the  onset  of 
flashover  at  about  210  seconds.  With  water  spray, 
flashover  was  prevented  over  the  5-minute  test  duration 
and  the  cabin  environment  (away  from  the  fire  source) 
remained  survivable.  On  the  basis  of  the  FED 
calculation,  the  improvement  in  survival  time  at  the  end 
of  the  test  was  85  seconds,  and  would  likely  have  been 
considerably  longer,  perhaps  2-3  minutes,  had  the  test 
not  been  terminated. 

4.  OPTIMIZATION  OF  CABIN  WATER  SPRAY 
SYSTEM 

Because  of  payfrad,  weig'  l  penalty  is  an  overriding 
consideration  in  aircraft  design.  The  weight  penalty 
associated  with  the  SAVE  system  is  somewhat 
excessive,  if  not  prohibitive.  The  concept  of  a  zoned 
system  divides  an  airplane  cabin  into  a  series  of  water 
spray  zones.  Discharge  of  water  within  each  zone  is 
independent  of  the  other  zones  and  triggered  by  a 
sensor  within  the  zone.  In  this  matter  the  quantity  of 
water  discharged  is  dictated  by  the  presence  and  spread 
of  fire,  eliminating  the  ineffectual  and  wasteful 
discharge  of  water  away  from  the  fire  as  in  the  SAVE 
system  (Marker,  1991).  A  zoned  system  was  designed, 
tested  and  optimized  in  the  narrow  body  test  article. 

Each  zone  was  8  feet  in  cabin  length.  Four  spray 
nozzles  were  mounted  at  the  cabin  periphery  in  each  of 
the  two  boundary  planes,  with  the  spray  discharge 
directed  toward  the  center  of  the  zone.  Based  on 
preliminary  tests,  a  temperature  of  300  degrees 
Farenheight  (F)  was  selected  to  manually  activate  water 
discharge.  The  temperature  was  measured  at  ,.ie  center 
of  the  zone  about  6  inches  below  the  ceiling  .  Three 
types  of  nozzles  were  evaluated;  low,  0.23  gallons  per 
minute  (gpm)  (SAVE  nozzle);  medium,  0.35  gpm;  and 
high,  0.50  gpm.  A  more  severe  simulated  wind 
condition  than  employed  previously  was  used  as  the 
test  condition. 

The  calculated  FED  profiles  from  the  initial  series  of 
optimization  tests  are  shown  in  figure  5.  The  SAVE 
water  spray  system,  discharging  72  gallons  of  water, 
increased  the  survival  time  by  110  seconds.  More 
importantly,  the  medium  and  high  flow  rate  nozzles, 
discharging  a  total  of  only  24  gallons  of  water, 
increased  the  survival  time  beyond  the  SAVE  system 
by  about  55  seconds  and  35  seconds,  respectively.  The 
improvement  provided  by  the  higher  flow  rate  nozzles 
is  apparently  due  to  the  application  of  larger  quantities 
of  water  where  it  is  needed  most  --  in  the  immediate 
fire  area.  An  interesting  result  is  that  the  medium  flow 
rate  nozzles  provided  more  protection  than  the  high 
flow  rate  nozzles.  A  possible  explanation  is  that  the 
discharge  time  was  longer  with  the  medium  flow  rate 
nozzles;  i.e.,  180  seconds  versus  140  seconds. 


In  an  attempt  to  optimize  the  zoned  system,  9  zoned 
water  spray  tests  were  conducted,  employing  4  water 
quantities  and  3  nozzle  flow  rates.  The  results  are 
summarized  in  figure  6  in  terms  of  the  additional 
available  escape  time  beyond  the  baseline  test  without 
water  discharge.  The  results  of  the  SAVE  test  are  also 
shown  (108  seconds  additional  escape  time).  Each  of 
the  zoned  tests  provided  a  significant  improvement  in 
the  additional  escape  time,  which  was  greater  than  the 
improvement  with  the  SAVE  system  in  5  of  the  9  cases. 
Even  with  only  4  gallons  of  water,  the  zoned  system 
was  effective,  increasing  the  available  escape  time  by 
53  seconds.  The  optimal  nozzle  discharge  rate  was  0.35 
gpm. 

In  order  to  optimize  the  water  quantity,  the  efficiency 
of  a  water  spray  system  was  defined  as  the  ratio  of  the 
additional  available  escape  time  (seconds)  to  the 
quantity  of  water  discharged  (gallc.o),  or  seconds  per 
gallons  (SPG).  Figure  7  compares  SPG  for  the  various 
water  spray  configurations  on  the  basis  of  nozzle  flow 
rate.  It  is  evident  that  the  most  efficient  or  optimum 
zoned  system  utilized  a  medium  flow  rate  nozzle  (0.35 
gpm)  and  a  water  quantity  of  8  gallons.  The  optimum 
zoned  water  spray  system  (SPG  =  20.4)  was  a  factor  of 
13.6  more  efficient  than  the  continuous  waters  spray 
system  (SPG  =  1 .5).  It  is  significant  that  as  much  as  20 
seconds  of  additional  available  escape  time  per  gallon 
of  water  discharged  may  be  achieved  by  a  water  spray 
system,  operating  effectively  in  a  postcrash  fire 
environment,  where  each  second  of  available  escape 
time  is  critical. 

Improved  visibility  is  another  advantage  of  a  zoned 
water  spray  system  since  continuously  discharging 
water  throughout  the  airplane  tends  to  lower  the  ceiling 
smoke  layer.  With  the  zoned  system  the  disruption  of 
the  smoke  la>_r  is  primarily  confined  to  the  spray 
zones.  Visibility  during  the  zoned  system  tests 
improved  by  approximately  40-50  seconds  compared  to 
the  SAVE  system  test  (figure  8). 

5.  EFFECTIVENESS  OF  ZONED  CABIN  WATER 
SPRAY  SYSTEM 

Wide-Bodv  Test  Article.  The  effectiveness  of  a  zoned 
water  spray  system  was  examined  in  the  wide-body  test 
article.  The  placement  of  nozzles  was  similar  to  the 
narrow-body  arrangement  with  two  exceptions.  First, 
there  were  six  nozzles  in  each  of  the  two  boundary 
planes.  Second,  for  some  tests  a  half-zoned  geometry 
was  used;  i.e.,  the  zone  extended  to  the  cabin  symmetry 
plane  rather  than  across  the  full  cabin  width.  Another 
variation  in  some  tests  was  the  spray  discharge 
activation  temperature.  As  in  the  narrow-body  tests, 
initial  activation  of  spray  discharge  was  set  at  300 
degrees  F;  however,  subsequent  zone  activation’s  were 
delayed  until  the  temperature  reached  500  degrees  F. 
This  was  done  with  the  aim  of  conserving  water  for 
application  in  the  initial  zone  where  the  fire  intensity 
was  greatest.  The  total  quantity  of  water  was  only  21 
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gallons  (vs.  195  gallons  with  the  SAVE  system).  This 
was  calculated  by  scaling  to  the  optimum  zone  system 
and  SAVE  system  water  quantities  in  the  narrow-body 
test  article. 

The  calculated  FED  profiles  are  shown  in  figure  9.  As 
in  the  narrow-body  test  article,  the  zoned  water  spray 
configurations  provided  a  significant  increase  in 
survival  time,  ranging  form  86  to  103  seconds  under 
the  conditions  tested.  Again,  the  medium  flow  rate 
nozzle  (0.35  gpm)  was  more  effective  than  the  high 
flow  rate  nozzle  (0.50  gpm),  although  by  a  relatively 
small  amount  (10  seconds).  Small  improvements  are 
also  seen  from  split  zoning  and  elevation  of  discharge 
activation  temperature  in  secondary  zones  (7  seconds). 

Commuter  Test  Article.  Currently,  small  commuter 
aircraft  (19  seats  or  less)  are  exempt  from  the  stringent 
FAA  regulations  require  seat  cushion  fire  blocking 
layers  and  low  heat  smoke  release  panels  in  large 
transport  aircraft.  To  determine  potential  improvements 
in  postcrash  fire  survivability  from  usage  of  more  fire 
resistant  materials  in  commuter  aircraft,  and  from  a 
zoned  water  spray  system,  a  series  of  full-scale  tests 
were  conducted  in  a  Metroliner  fuselage. 

The  fire  scenario  setup  for  the  commuter  test  article 
was  similar  to  that  used  in  the  large  transport  test 
articles,  except  on  a  reduced  scale;  e.g.,  4-by-5-foot  pan 
fire  adjacent  to  20-by-26-inch  initial  fuselage  opening. 
The  water  spray  system  was  comprised  of  100  inch 
long  zones,  with  each  zone  containing  six  nozzles.  Only 
5  gallons  of  water  was  discharged. 

Figure  10  presents  the  survival  time  improvements 
resulting  from  fire  blocked  seats,  improved  panels  and 
a  water  spray  system.  Each  fire  safety  design 
improvement  created  finite  survival  gains.  By  far  the 
largest  increase  in  survival  time  was  furnished  by  the 
water  spray  system  -  over  3  minutes,  ft  was  also  shown 
in  other  tests  that  this  incremental  improvement  would 
also  be  attained  with  less  fire  resistant  materials.  It  is 
interesting  that  the  survival  time  improvement  for  seat 
fire  blocking  layers,  45  seconds,  is  within  the  range 
measured  previously  in  large  transport  full-scale  fire 
tests  (Sarkos,  1989). 

6.  EVALUATION  OF  CARGO  COMPARTMENT 
WATER  SPRAYS 

An  in-flight  cargo  fire  presents  a  totally  different  fire 
threat  than  a  postcrash  cabin  fire.  The  latter  is  an 
intense,  open  fire  which  must  be  suppressed  for  several 
minutes  in  order  to  enable  passengers  to  escape.  A 
cargo  fire,  however,  may  be  a  deep-seated  fire, 
potentially  involving  a  wide  variety  of  cargo  and 
baggage  materials,  which  must  be  suppressed  and 
contained  within  the  confines  of  the  cargo 
compartment.  The  period  of  protection  must  allow  the 
airplane  to  be  safely  landed,  which  in  some  cases  may 
be  as  long  as  180  minutes. 


The  cargo  compartment  water  spray  tests  conducted  to 
date  represent  a  worst  case  scenario.  Since  it  is 
expected  that  water  spray  will  effectively  extinguish  or 
suppress  a  fire  originating  in  bulk-loaded  cargo,  testing 
has  focused  on  water  spray  protection  against  fires  in 
cargo  containers.  The  test  arrangement  is  shown  in 
figure  1 1 .  It  would  appear  that  a  containerized  cargo 
fire  presents  greater  discharge  obstructions  and  less 
opportunity  for  soaking  of  cargo  materials  than  a  bulk- 
loaded  cargo  fire  (individually  loaded  luggage  and/or 
cargo).  A  standard  fire  load,  consisting  of  cardboard 
boxes  filled  with  shredded  paper  at  a  packing  density  of 
2.5  pounds  per  cubic  foot,  was  employed  in  all  the 
tests.  An  unsuppressed  fire  bums  out  of  the  container 
through  the  polycarbonate  walls.  Aircraft  Halon  1301 
systems  are  designed  to  maintain  an  inerting 
concentration  of  Halon  1301  (>3%)  throughout  the 
period  of  protection,  in  effect,  suppressing  a  deep- 
seated  fire  by  preventing  the  occurrence  of  open 
flaming. 

Two  types  of  nozzles  were  evaluated  in  a  zoned  water 
spray  configuration  -  high  pressure  and  dual  fluid.  The 
high  pressure  nozzle  produced  a  water  fog  at  a  flow 
rate  of  .027  liters/minute;  the  dual  fluid  nozzle 
discharged  water  mist  at  2.5  liters/minute.  Since  water 
did  not  remain  suspended  in  air  for  any  appreciable 
time  with  either  system,  it  was  necessary  to  control  the 
discharge  of  water  based  on  temperature  measurements 
taken  within  each  zone. 

The  dual  fluid  nozzle  water  spray  system  was  evaluated 
initially.  A  series  of  eight  tests  were  conducted, 
varying  the  discharge  activation  temperature  (200- 
300°F),  deactivation  temperature  (150-290°F),  and/or 
spray  duration  (6-10  seconds).  The  dual  fluid  nozzle 
system  was  effective  in  controlling  the  cargo  fire,  but 
the  required  quantity  of  water  was  excessive,  ranging 
from  80  to  110  gallons,  and  showed  little  sensitivity  to 
the  parameters  studied. 

The  initial  tests  with  a  high  pressure  spray  system 
exhibited  some  reduction  in  the  required  quantity  of 
water  (minimum  of  65  gallons).  However,  in  order  to 
be  a  candidate  replacement  for  a  Halon  1301  system, 
the  water  usage  should  be  in  the  10  to  20  gallon  range. 
Therefore,  the  nozzle  arrangement  was  modified  by 
incorporating  nozzles  which  sprayed  directly 
downward  in  the  space  between  the  containers,  in 
addition  to  the  previous  arrangement  of  nozzles  which 
sprayed  horizontally  at  the  ceiling.  Figure  12  shows 
this  nozzle  arrangement.  Also  shown  is  the  cargo 
container  fire  configuration  employed  throughout  the 
test  program.  As  shown  in  Figure  12,  the  fire  origin 
was  in  the  lower  comer  container  (the  adjacent  “blank” 
containers  provided  discharge  obstructions).  There 
were  a  total  of  eight  spray  zones,  although  only  the 
single  zone  in  which  the  fire  was  started  activated  in  all 
of  the  tests.  The  fire  zone  discharged  water  at  a  rate  of 
1 .0  gallon  per  minute  (minimum  flow  rate  required  to 
suppress  the  fire). 
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A  typical  water  spray  test  with  the  high  pressure  system 
is  shown  in  figure  13.  A  200°F  activation  temperature, 
20  second  spray  duration  and  10  second  scan  rate  was 
employed  during  the  test.  The  ceiling  temperature 
measured  above  the  cargo  container  was  well  below  the 
safe  level.  Also,  the  oxygen  concentration  profile 
demonstrates  that  the  fire  was  controlled  by  water  spray 
(versus  oxygen  starvation).  The  quantity  of  water  used, 
41.3  gallons,  demonstrated  that  the  downward  spraying 
nozzles  significantly  reduced  water  usage  (65  gallons 
was  the  minimum  quantity  when  only  horizontal  spray 
nozzles  were  employed).  Moreover,  in  subsequent 
cargo  container  fire  tests,  by  modifying  certain  spray 
parameters,  the  fire  was  controlled  for  90  minutes  by 
utilizing  only  3 1 .0,  34.4  and  3 1 .6  gallons  of  water. 

In  order  to  evaluate  the  effectiveness  of  the  spray 
system  during  a  simulated  bulk  loaded  cargo  fire,  56 
shredded  paper  filled  boxes  were  arranged  in  two  tiers 
of  7  boxes.  A  second  water  spray  zone  with  a  high 
concentration  of  downward  spraying  nozzles  was  added 
because  the  floor  area  of  the  bulk  loaded  cargo 
occupied  two  zones.  The  flowrate  in  each  of  these 
zones  remained  at  1.0  gallons  per  minute  (identical  to 
the  container  test  which  needed  the  least  amount  of 
water).  During  the  first  test,  the  spray  was  activated 
when  the  ceiling  temperature  reached  250°F,  which 
allowed  temperature  excursions  within  the 
compartment  to  reach  unacceptable  levels  (300°F  to 
800°F).  Because  the  high  activation  temperature 
allowed  the  fire  to  grow  sizably  before  allowing  the 
system  to  gain  control,  an  excessive  42  gallons  of  water 
was  used.  The  next  test  used  a  150°F  activation 
temperature,  which  produced  noticeably  superior 
results  in  terms  of  both  the  temperatures  observed  and 
the  amount  of  water  required  (24.8  gallons). 

7.  SUMMARY  OF  RESULTS 

Full-scale  tests  demonstrated  that  an  on-board  cabin 
water  spray  system  provided  significant  increases  in 
survival  time  in  all  transport  aircraft  sizes  during  a 
postcrash  fire.  The  main  benefits  of  water  spray  were  to 
delay  the  onset  of  flashover,  reduce  cabin  air 
temperatures,  and  remove  water-soluble  toxic  gases. 
Moreover,  a  zoned  water  spray  system,  utilizing 
relatively  small  quantities  of  water,  increased  the 
survival  time  and  improved  visibility  when  compared 
to  a  system  that  continuously  discharged  water 
throughout  the  cabin.  Enhancement  in  survivability  by 
zoning  was  attributed  to  concentrating  the  discharge  of 
water  to  those  cabin  areas  where  the  fire  originated  and 
spread,  and  to  reducing  the  lowering  of  the  smoke  layer 
caused  by  water  discharge.  Full-scale  tests  also 
demonstrated  that  a  cargo  compartment  zoned  water 
spray  system,  employing  either  dual  fluid  or  high 
pressure  nozzles,  effectively  controlled  a  deep-seated 
in-flight  fire,  originating  inside  a  cargo  container,  for  a 
period  of  90  minutes.  Significant  reduction  in  water 
quantities  were  attained  by  altering  the  nozzle 


arrangement  and  optimizing  certain  discharge 
parameters,  such  as  zone  spray  activation  temperature. 

8.  THE  FUTURE  OF  AIRCRAFT  WATER  SPRAY 
SYSTEMS 

The  full-scale  cabin  fire  tests  described  in  this  paper 
was  part  of  a  broad  multi-national  program,  conducted 
primarily  by  FAA  and  CAA,  to  determine  the 
feasibility  and  practicality  of  an  onboard  cabin  water 
spray  system  for  enhanced  postcrash  fire  survivability. 
Various  tests  and  studies  were  conducted  to  address  the 
following  issues:  system  effectiveness,  system 
optimization,  physiological  hazards  and  other  human 
factors,  safety  benefit  analysis,  manufacturer’s 
disbenefits  studies,  airworthiness  requirements  and  cost 
analysis  (CAA,  1993).  It  was  essentially  determined 
that  a  zoned  cabin  water  spray  system  is  effective,  safe 
and  practical  (some  protective  measures  may  be  needed 
to  tolerate  an  inadvertent  discharge).  These  findings 
led  to  consideration  of  the  of  the  development  and 
evaluation  of  a  prototype  water  spray  system  in  an 
operational  aircraft.  Further  development  of  a  cabin 
water  spray  system,  however,  was  discontinued  after  a 
cost/benefit  analysis  determined  the  high  costs 
associated  with  life  saving  potential,  approximately 
$20-30  million  per  life  saved  (CAA,  1993). 

An  aircraft  cabin  water  spray  system  may  still  be  a 
viable  concept.  Although  the  average  benefit  based  on 
an  analysis  of  past  accidents  and  factoring  in  the  impact 
of  regulatory  fire  safety  improvements  is  relatively 
small,  there  is  the  potential  for  alleviating  a  major  loss 
of  life  in  a  single  accident.  The  potential  benefit  may 
be  even  more  pronounced  in  future,  high  capacity 
double-decked  transports.  Most  important,  however,  is 
the  potential  significant  reduction  in  cabin  system  cost 
if  water  spray  were  also  incorporated  as  a  halon 
alternative  fire  suppression  agent  in  cargo 
compartments.  It  is  conceivable  that  the  quantity  of 
water  required  to  suppress  a  cargo  compartment  fire 
will  also  provide  adequate  capacity  to  supply  a  zoned, 
cabin  water  spray  system.  Utilization  of  potable  water 
offers  added  protection  and  cost  reduction  depending 
on  the  fire  scenario,  flight  type  (over  land  vs.  over 
water),  etc. 

Initially,  aircraft  manufacturers  and  airlines  generally 
favored  a  gaseous  halon  replacement  agent  in  cargo 
compartments,  primarily  because  gases  are  “clean”  and 
would  require  virtually  no  cleanup  in  the  event  of  an 
accidental  discharge.  However,  currently  available 
halon  replacement  gaseous  agents  have  one  or  more  of 
the  following  disadvantages:  additional  weight  and 
volume,  greater  toxicity,  unknown  future 
environmental  restrictions,  and  higher  cost.  Obviously, 
toxicity,  environmental  concerns  and  cost  (agent)  are 
not  concerns  with  water.  Freezing  is  an  issue  that  needs 
to  be  addressed.  Further  reduction  in  the  quantity  of 
water  required  to  suppress  a  cargo  fire  may  be  possible 
because  of  the  many  options  offered  by  zoned  water 
spray.  Water  spray  in  aircraft  cargo  compartment  fire 
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suppression  systems  is  a  halon  replacement  option  that 
exhibits  more  promise  than  envisioned  several  years 
ago. 
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FIGURE  1 .  NARROW  CABIN  BODY  TEST  SETUP 
SAVE  SYSTEM 


FIGURE  2.  NARROW  CABIN  BODY  RESULTS/SAVE 
SYSTEM/ZERO  WIND 
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WITHOUT  WATER 


WITH  WATER 


TEMPERATURE  STA.  400 


HYDROGEN  FLUORIDE 
STATION  800  AT  3'6" 
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FIGURE  3.  NARROW  CABIN  BODY  RESULTS/SAVE  SYSTEM/MODERATE  WIND 


WITHOUT  WATER 


WITH  WATER 


(a) 


TEMPERATURE  PROFILE  STA  220 
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FIGURE  4.  WIDE  CABIN  BODY  RESULTS/SAVE  SYSTEM/MODERATE  WIND 
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TOTAL  QUANTITY  OF  WATER  (GALLONS) 


FIGURE  5.  CABIN  ZONED  SYSTEM  SURVIVAL 
TIME  IMPROVEMENT,  24  GALLONS 


FIGURE  6.  CABIN  ZONED  WATER  SPRAY  TEST 
RESULTS  ADDITIONAL  ESCAPE  TIME 


FIGURE  7.  CABIN  ZONED  WATER  SPRAY 
OPTIMIZATION  TEST  RESULTS 


FIGURE  8.  CABIN  ZONED  SYSTEM  VISIBILITY 
. IMPROVEMENT 


"AIF  low 


FIGURE  9.  WIDE-BODY  CABIN  ZONED  SYSTEM 
SURVIVAL  TIME  IMPROVEMENT 


FIGURE  10.  SURVIVABILITY  IMPROVEMENTS 
IN  COMMUTER  TEST  ARTICLE 
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•i  solenoid  valve 
*.  nozzle  facing  downward 
:  nozzle  facing  horizontally 


FIGURE  12.  CARGO  COMPARTMENT  HIGH  PRESSURE  SPRAY  SYSTEM 


Time  (minutes) 


FIGURE  13.  HIGH  PRESSURE  CARGO  COMPARTMENT  SYSTEM 
OXYGEN  AND  TEMPERATURE  PROFILES 
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DISCUSSION  -  PAPER  NO.  12 


A.  Mulder  (Comment  &  Questions) 

Comment'.  Very  worthwhile  research. 

Questions : 

1)  Is  there  any  knowledge  about  the  difference  in  hazards  between  inhaling 
smoke,  and  smoke  mixed  with  water  mist? 

2)  With  respect  to  Water  Spray  Systems  in  cargo  compartment,  are  the  so- 
called  ‘shaded  areas’  not  a  problem? 

C.P.  Sarkos  -  Author  (Response) 

1)  What  is  most  important  is  a  comparison  of  the  hazards  at  a  given  location 
and  point  in  time  with  water  spray  and  without  water  spray.  Measurements  during 
full-scale  fire  tests  with  water  spray  show  significantly  lower  temperatures  and 
toxic  gas  concentrations  than  without  water  spray.  Also,  the  occurre'  ~e  of 
flashover  is  delayed  significantly.  Similarly,  in  tests  sponsored  by  the  CAA,  the 
collection  of  particles  of  various  sizes  that  could  be  ingested  showed  lower  levels 
of  harmful  deposits  when  water  spray  was  used. 

2)  FAA  cargo  compartment  fire  tests  have  focused  on  the  ‘shaded  area’  created 
by  a  cargo  container  fire.  Until  the  fire  bums  out  of  the  container,  any  water  spray 
discharge  will  be  shielded  from  the  fire.  By  using  a  ceiling  temperature  sensor,  the 
fire  could  be  controlled  for  90  minutes  by  discharging  water  for  20  seconds  if  the 
temperature  exceeded  200°F  (10-second  interrogation  time). 

N.J.  Povey  (Comment) 

Additional  comment  to  previous  questions  and  answers.  The  CAA,  as  part  of 
the  joint  FAA/CAA/TCCA  programme  -  conducted  a  study  (performed  by  Dr. 
David  Purser  -  to  investigate  the  risk  posed  by  respirable  water  droplets  (reported 
in  CAA  Paper  93009).  Conclusion  was  that  there  was  no  additional  risk.  The 
benefit  of  water  in  stopping  the  production  of  toxic  gases  far  exceeded  any 
additional  risk  of  respirable  droplets. 

H.  Schmidt  Question) 

Did  you  investigate  the  influence  of  droplet  size  or  droplet  size  distribution  to 
extinguishing  efficiency? 

C.P.  Sarkos  -  Author  (Response) 

We  did  not  investigate  the  variation  of  droplet  size  to  determine -its  effect  on 
extinguishment  efficiency.  The  cabin  water  spray  system  employed  a  mean  droplet 
diameter  of  about  1  OOp.  One  concern  for  the  cabin  system  was  not  to  employ 
droplet  sizes  in  the  20-3 Op  range  which  might  be  respirable.  Smaller  droplet  sizes 
were  used  in  the  cargo  system  with  the  hope  that  a  total  flooding  behaviour  would 
result  and  the  droplets  would  remain  suspended  for  long  periods  of  time. 
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W.B.  de  Wolf  (Question) 

1)  Could  you  comment  on  the  cost/benefit  aspect  of  water  spray  systems  based 
on  the  present  technical  status? 

2)  Could  you  also  comment  on  possible  patent  issues? 

R.G.  Hill  -  Author  (Response) 

1)  Cabin  water  mist  systems  have  not  been  shown  to  be  cost  beneficial  at 
present.  However,  if  a  cargo  water  mist  system  is  shown  to  be  acceptable  as  a 
Halon  replacement,  the  cost  of  additional  cabin  protection  may  become  cost 
beneficial. 

2)  Although  some  components  specific  to  water  mist  systems  may  be  patented, 
the  concept  is  not. 
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Full-Scale  Test  Evaluation  of  Aircraft  Fuel  Fire 
Burn-Through  Resistance  Improvements 

Timothy  R.  Marker  and  Constantine  P.  Sarkos 

Federal  Aviation  Administration,  William  J.  Hughes  Technical  Center 


Abstract 

Fuselage  bum-through  refers  to  the  penetration  of  an  external  post-crash  fuel  fire  into 
an  aircraft  cabin.  The  time  to  burn-through  is  critical  because,  in  a  majority  of 
survivable  aircraft  accidents  accompanied  by  fire,  ignition  of  the  cabin  materials  is 
caused  by  burn-through  from  burning  jet  fuel  external  to  the  aircraft.  There  are  typically 
three  barriers  that  a  fuel  fire  must  penetrate  in  order  to  burn-through  to  the  cabin 
interior:  aluminum  skin,  the  thermal  acoustical  insulation,  and  the  interior  side¬ 
wall/floor  panel  combination.  The  bum-through  resistance  of  the  aluminum  skin  is  well 
known,  lasting  between  20  to  60  seconds,  depending  on  the  thickness.  Thermal 
acoustical  insulation,  typically  comprised  of  fiberglass  batting  encased  in  a  poly- 
vinylfluoride  (PVF)  moisture  barrier,  can  offer  an  additional  one  to  two  minutes  if  the 
material  is  not  physically  dislodged  from  the  fuselage  structure.  Honeycomb  sandwich 
panels  used  in  the  sidewall  and  floor  areas  of  transport  aircraft  offer  a  substantial  barrier 
to  fire;  however,  full-scale  testing  has  shown  that  a  large  fire  can  penetrate  through 
other  openings,  such  as  the  seams  between  sidewall  panels,  window  reveals,  and  floor 
air  return  grilles.  Of  the  three  fire  barriers,  research  has  shown  that  large  increases  in 
burn-through  resistance  can  be  gained  by  using  alternate  materials  in  place  of  the 
existing  fiberglass  based  thermal  acoustical  insulation.  In  particular,  a  heat-treated, 
oxidized  polyacrylonitrile  fiber  was  shown  to  increase  the  burn-through  resistance  by 
several  minutes  over  current  insulation,  offering  potential  life  savings  during  a  post- 
crash  fire  accident  in  which  the  fuselage  remains  intact. 
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Introduction 

Background 

In  a  majority  of  survivable  accidents  accompanied  by  fire,  ignition  of  the  interior  of 
the  aircraft  is  caused  by  burning  jet  fuel  external  to  the  aircraft  as  a  result  of  fuel  tank 
damage  during  impact.  One  important  factor  to  occupant  survivability  is  the  integrity 
of  the  fuselage  during  an  accident.  There  are  typically  two  possibilities  which  exist  in 
an  aircraft  accident:  1)  an  intact  fuselage,  or  2)  a  crash  rupture  or  an  emergency  exit 
opening  occurs,  allowing  direct  impingement  of  external  fuel  fire  flames  on  the  cabin 
materials.  Based  on  a  consideration  of  past  accidents,  experimental  studies,  and 
fuselage  design,  it  is  apparent  that  the  fuselage  rupture  or  opening  represents  the  worst 
case  condition  and  provides  the  most  significant  opportunity  for  fire  to  enter  the  cabin 
(Sarkos  1988).  Past  Federal  Aviation  Administration  (FAA)  regulatory  actions  govern¬ 
ing  interior  material  flammability  were  based  on  full-scale  tests  employing  a  fuel  fire 
adjacent  to  a  fuselage  opening  in  an  otherwise  intact  fuselage.  This  scenario,  in  which 
the  cabin  materials  were  directly  exposed  to  the  intense  thermal  radiation  emitted  by 
the  fuel  fire,  represented  a  severe,  but  survivable,  fire  condition  against  which  to 
develop  improved  standards.  However,  in  some  crash  accidents,  the  fuselage  remained 
completely  intact  and  fire  penetration  into  the  passenger  cabin  was  the  result  of  a 
bum-through  of  the  fuselage  shell  (Sarkos  1990).  At  least  10  transport  accidents 
involving  bum-through  have  occurred  in  the  last  20  years,  five  in  which  the  rapid  fire 
penetration  of  the  fuselage  was  a  primary  focus  of  the  investigation:  Los  Angeles  1972; 
Malaga  1982;  Calgary  1984;  Manchester  1985;  and  Anchorage  1987. 
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Accident  Data 


An  example  of  an  accident  involving  fuselage  burn-through 
with  a  large  loss  of  life  occurred  in  Manchester,  England  in 
1985.  During  this  accident,  a  B-737  was  approaching  takeoff 
when  it  experienced  an  uncontained  engine  failure,  propelling 
pieces  of  the  engine  into  the  wing,  and  subsequently  rupturing 
the  wing  fuel  access  door  area.  The  takeoff  was  aborted.  As  the 
airplane  decelerated,  leaking  fuel  ignited  and  burned,  erupting 
into  a  large  ground  fire  after  the  plane  came  to  rest.  Although 
the  fire  fighting  response  was  practically  immediate,  55  occu¬ 
pants  perished  from  the  effects  of  the  fire.  In  this  accident,  it 
was  believed  that  the  external  fire  caused  a  very  rapid  burn- 
through  of  the  lower  fuselage  skin  and  quickly  involved  the 
cabin  furnishings  by  gaining  entry  through  the  baseboard 
return  air  grills  (reference  Air  Accidents  Investigation  Branch 
1988  report). 

Although  fire  can  penetrate  into  the  passenger  compartment 
by  a  variety  of  paths,  including  the  windows,  the  sidewall 
(above  floor),  cheek  area  (below  floor),  cabin  floor,  and  base¬ 
board  return  air  grilles,  there  is  no  set  pattern  based  on  past 
accidents  or  experimental  test  data  to  indicate  which  areas  are 
the  most  vulnerable.  Testing  had  been  performed  on  the  indi¬ 
vidual  components  (aluminum  skin,  windows,  thermal-acous¬ 
tical  insulation,  and  interior  sidewall  panels)  but  had  not  been 
done  on  the  complete  fuselage  shell  system  in  which  fire 
penetration  paths  and  burn-through  times  could  be  observed. 
For  this  reason,  an  initial  test  program  was  conducted  to 
determine  these  mechanisms  and  the  likely  time  framework 
required  for  bum-through  to  occur. 

Experimental 

Initial  Fuselage  Testing 


To  better  understand  and  quantify  the  fuselage  burn-through 
problem,  the  FAA  conducted  a  series  of  full-scale  tests  by 
subjecting  surplus  aircraft  (DC-8  and  Convair  880)  fuselages 
to  37  square  meter  fuel  fires  (20  x  20  feet).  The  fuel  fires  were 
set  adjacent  to  intact  fuselage  sections  instrumented  with  ther¬ 
mocouples,  heat  flux  transducers,  and  cameras  to  determine 
penetration  locations,  fire  paths,  and  important  event  times 
(Webster,  1990).  Several  major  findings  were  concluded  in 
terms  of  the  likely  entrance  paths  of  the  fire  and  the  time 
required  to  involve  the  cabin  interior  materials.  The  tests 


indicated  that  the  aluminum  skin  provides  protection  from  a 
fully  developed  pool  fire  for  30  to  60  seconds  and  that  the 
windows  are  effective  flame  barriers  until  they  shrink  due  to 
the  radiant  heat  of  the  fire  and  fall  out  of  place,  allowing  flame 
penetration.  These  findings  were  consistent  with  data  obtained 
during  the  investigation  of  the  above  mentioned  accidents.  The 
tests  also  highlighted  the  importance  of  thermal-acoustical 
insulation  in  preventing  fire  penetration.  It  was  observed  that 
the  insulation  can  provide  a  significant  delay  in  the  bum- 
through  process,  provided  it  remains  in  place  and  is  not  physi¬ 
cally  dislodged  from  its  position  by  the  updrafts  of  the  fire. 
Several  other  findings  were  highlighted,  including  the  ability 
of  the  flames  to  gain  access  to  the  cabin  by  first  penetrating 
tnto  the  cheek  area  and  then  progressing  upward  through  the 

.floor  air  return  grills.  The  information  obtained  during  this  test 
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project  was  used  as  a  basis  in  the  development  of  a  full-scale 
burn-through  test  rig. 

Development  of  a  Full-Scale  Burn-Through  Test  Rig 

The  next  phase  of  the  program  involved  the  development  of 
a  test  apparatus  by  which  improvements  could  be  evaluated 
under  realistic  conditions.  The  construction  of  a  full-scale  test 
rig  was  the  most  practical  approach  that  would  allow  repetitive 
testing  and  systematic  evaluation  of  singular  components.  To 
accommodate  this,  a  6.  1  meter  (20  foot  long)  steel  test  rig  was 
fabricated,  and  a  707  fuselage  was  cut  in  half,  and  the  test  rig 
was  then  inserted  between  the  two  fuselage  halves  (Figure  1). 
This  test  rig  had  a  1 2  x  8  foot  section  of  the  outer  skin  removed 
which  could  be  mocked-up  with  aluminum  skin,  thermal 
acoustical  insulation,  floor  and  sidewall  panels,  carpet,  and 
cargo  liner.  The  mocked-up  test  rig  extends  beyond  the  3.0 
meter  (10  foot  long)  fire  pan,  eliminating  any  edge  effects  or 
mating  problems  that  might  occur  if  the  test  rig/707  fuselage 
seams  were  in  direct  exposure  to  the  fuel  fire.  Measurements 
of  temperature,  smoke,  and  fire  gases  (CO,  CO2,  and  O2)  are 
taken  inside  the  test  rig,  along  with  video  coverage  at  several 
locations  to  determine  exact  burn-through  locations  and  times. 

Characterization  of  the  Fuel  Fire 

Prior  to  commencement  of  the  mock-up  tests,  the  fuselage 
exterior  surface  was  instrumented  with  thermocouples,  calo¬ 
rimeters,  and  radiometers  in  an  effort  to  quantify  test  fires  at 
different  fuselage  locations.  During  past  test  programs,  ground 
fires  of  this  size  were  ignited  next  to  fuselages  at  the  cabin  floor 
level  and  adjacent  to  a  Type  A  opening  to  simulate  an  open 
ascape  exit  or  fuselage  rupture.  It  was  determined  from  these 
earlier  tests  however,  that  from  a  burn-through  standpoint,  a 
more  severe  condition  results  when  the  fire  is  beneath  the 
fuselage,  allowing  the  higher  temperatures  of  the  upper  flame 
area  to  come  in  contact  with  the  lower  fuselage.  Two  fire  pan 
locations  were  tested,  and  the  location  that  provided  the  more 
severe  results  of  the  two  was  established  as  the  standard  fire 
condition  for  future  material  mock-up  tests.  These  tests  also 
provided  information  on  the  radiative  and  convective  heat  flux 
produced  by  fire  of  this  size.  Typically,  the  fuselage  skin  is 
subjected  to  maximum  heat  fluxes  of  between  15.9  and  18.2 
W/cm2  (14  and  16  Btu/Ft2  sec)  when  measured  with  a  Ther- 


Figure  1.  Fuselage  burn-through  test  rig. 


moguage  calorimeter  (combined  radiative  and  convective  heat 
flux).  By  comparison,  a  Thermoguage  radiometer  with  a  136 
degree  angle  of  incidence  (radiative  heat  flux  only)  reached 
approximately  13.6  W/cm2  (12  Btu/Ft2  sec). 

Initial  Baseline  Tests 

In  order  to  evaluate  potential  improvements  in  materials  and 
systems  for  better  resistance  to  fuel  fire  penetrations,  a  baseline 
test  arrangement  was  established  using  in-service  materials. 
An  aluminum  skin  section  measuring  2.44  m  high  by  3.66  m 
wide  (8x12  feet)  was  installed  where  the  original  skin  of  the 
test  rig  was  removed.  It  consisted  of  two  sheets  of  0.16  cm 
(0.063  inch  thick)  Alclad  2024  T3  aluminum  heli-arced  to¬ 
gether.  The  aluminum  panel  extended  from  the  lower  fuselage 
quadrant  up  to  the  window  level  and  was  mounted  to  the  test 
rig  stringers  and  ribs  using  steel  rivets  to  reduce  the  potential 
for  separation  during  testing.  The  remaining  area  of  the  test  rig 
was  covered  with  22  gauge  sheet  metal.  The  first  several  tests 
utilized  custom  made  insulation  batting,  consisting  of  Owens- 
Corning  Aerocor  fiberglass  insulation  encapsulated  in  Orcon 
brand  heat  shrinkable  metallized  polyvinylfluoride  (PVF) 
film,  type  AN-18R.  The  insulation  and  batting  material  was 
sized  to  fit  in  the  spaces  outlined  by  the  vertical  formers  and 
the  horizontal  stringers  of  the  test  rig.  The  insulation  bats 
spanned  the  entire  area  of  the  aluminum  skin,  2.44  x  3.66  m  (8 
x  12  feet).  In  the  test  rig  cargo  compartment,  0.033  cm  (0.013 
inch  thick)  Conolite  BMS  8-2A  fiberglass  liner  was  installed 
in  both  the  ceiling  and  sidewall  areas  facing  the  fire  and  held 
in  place  by  steel  strips  of  channel  screwed  into  the  steel  frame 
of  the  test  rig.  An  M.C.  Gill  “Gillfab”  4017  honeycomb  floor 
panel  measuring  1.22  x  3.66  m  (4  x  12  feet)  was  installed  in 
the  test  fig  cabin  floor  area  and  covered  with  FAA  approved 
aircraft  quality  wool/nylon  carpet.  The  remaining  test  rig  cabin 
floor  area  consisted  of  corrugated  sheet  steel.  Interior  sidewall 
panels  from  an  MD-80  aircraft  were  used;  these  panels  utilized 
an  aluminum  substrate  which  did  not  meet  the  current  FAAfire 
test  regulations  regarding  heat  release  rate.  The  outboard  cabin 
floor  area  contained  steel  plating  with  7.62  cm  (3  inch  diame¬ 
ter)  holes  to  simulate  the  venting  area  between  the  floor  and 
cheek  area.  Additionally,  an  aluminum  mesh  was  installed 
below  the  sidewall  panels  to  simulate  the  baseboard  air  return 
grills.  In  general,  the  major  components  of  a  typical  aircraft 
fuselage  were  represented  in  the  test  rig. 

During  the  first  test,  the  fire  burned  through  the  aluminum 
skin  within  30  seconds  and  quickly  displaced  or  penetrated  the 
thermal-acoustical  insulation  bats,  allowing  flames  to  enter  the 
cheek  area  within  40  seconds.  The  actual  point  of  first  pene¬ 
tration  into  the  cabin  was  difficult  to  decipher,  since  the  fire 
propagated  both  the  sidewall  panels  and  floor  return  air  grills 
within  a  short  time  of  one  another.  Early  indications  pointed 
to  the  lack  of  complete  coverage  by  the  2.54  cm  ( I  inch  thick) 
thermal-acoustical  insulation,  which  had  been  attached  to  the 
test  rig  by  loosely  packing  it  into  the  spaces  between  the 
stringers  and  formers  and  duct  taping  all  edges.  Since  a  major 
objective  is  to  determine  the  effectiveness  of  the  thermal- 
acoustical  insulation  when  it  is  not  physically  displaced,  ef¬ 
forts  were  made  to  better  secure  the  batting  material.  The 
thickness  of  the  insulation  was  also  increased  for  the  next  test. 


as  an  inspection  of  several  surplus  fuselages  revealed  that  the 
insulation  was  at  least  seven  centimeters  thick  in  the  sidewall 
area  (the  insulation  actually  becomes  much  thinner  at  the 
extreme  lower  section  of  the  fuselage,  due  to  lesser  acoustical 
requirements).  Although  the  thickness  of  insulation  varies 
slightly  between  aircraft,  it  was  found  to  be  at  least  several 
plies  thick  in  the  corresponding  areas  of  the  test  fuselage  where 
the  fire  had  penetrated  during  the  first  test.  The  results  of  the 
next  test  were  similar  to  the  first  in  terms  of  fire  propagation 
paths  and  burn-through  times,  but  again,  it  was  very  difficult 
to  pinpoint  the  actual  path  taken  because  of  the  visual  obstruc¬ 
tion  due  to  the  placement  of  the  sidewall  panels  and  cargo  liner. 
In  order  to  better  understand  the  bum-through  mechanism,  the 
subsequent  tests  were  conducted  without  sidewall  panels, 
cargo  liner,  and  floor  panels  to  allow  greater  visualization  of 
the  burn-through  point  and  time. 

Evaluation  of  Current  Insulation  Materials 

An  evaluation  of  current  fiberglass  insulation  was  conducted 
in  which  the  effects  of  the  thickness  and  the  method  of  instal¬ 
lation  on  burn-through  time  were  investigated.  A  surplus  of  the 
Aerocor  type  insulation  material  allowed  for  the  conduct  of 
several  tests  using  varying  layers.  As  shown  in  Figure  2,  the 
first  three  Aerocor  tests  utilized  7.62  cm  (3  inch  thick)  Aerocor 
encased  in  a  heat  shrinkable  metallized  polyvinylfluoride  film. 
The  method  of  Aerocor  attachment  was  refined  during  each 
test,  as  the  fire  visibly  dislodged  the  batting  materials  during 
the  first  and  second  tests  causing  burn-through  in  52  and  75 
seconds.  During  the  third  Aerocor  test,  heavier  spring  clips 
were  utilized  and  installed  around  the  entire  perimeter  of  each 
insulation  bat,  which  proved  to  be  a  very  effective  attachment 
system.  A  fourth  Aerocor  test  was  conducted  using  an  addi¬ 
tional  one  inch  layer  of  insulation,  which  provided  an  addi¬ 
tional  12  seconds.  Thus,  secured  insulation  provided  about  45 
seconds  of  additional  protection  after  the  aluminum  skin 
melted.  As  a  point  of  clarification,  the  time  to  bum-through  is 
determined  by  visual  observation  of  video  cameras  located  at 


Figure  2.  Fuselage  burn-through  resistance  current  fiberglass/PVF 

insulation  bags. 


SAMPE  Journal,  Vol.  33,  No.  4,  July/August  1997 


varii 

wha' 

alw; 

Sr 
tests 
curr 
ther 
tanc 
seci 
of  A 
abb 
who 
mil: 
ing. 
add 
moc 
fire 

V\ 
thr< 
in  : 
thei 
tinc 
insi 
gia 

Ev 

Ci 

i 

rev- 

rap 

bai 

poi 

sir 

mo 

ha- 

hib 


Q> 

Z3 

E 

5 

.c 

U) 

D 

O 

i_ 

sz 

h- 

c 

i- 

=3 

CO 

o 

o 

E 

P 


Fig 

ren- 

$a: 


ed  that  the 
ie  sidewall 
ner  at  the 
acoustical 
lion  varies 
ast  several 
1  age  where 
,ults  of  the 
ropagation 
i  y  difficult 
ial  obstruc- 
cargo  liner, 
mnism,  the 
all  panels,  j 
ilization  of  j 


trials 

conducted 
d  of  instal- 
iplus  of  the 
conduct  of 
gure  2,  the 
k)  Aerocor 
loridefilm. 
luring  each 
ials  during 
52  and  75 
pring  clips 
:ter  of  each 
attachment 
ng  an  addi- 
ed  an  addi- 
ed  about  45 
linum  skin 
i -through  is 
s  located  at 


various  places  in  the  test  rig  interior.  The  actual  time  is  some¬ 
what  subjective,  since  the  exact  time  and  location  are  not 
always  clearly  defined. 

Since  the  Aerocor  is  a  somewhat  dated  material,  additional 
tests  were  conducted  using  Microlite  AA  insulation  which  is 
currently  used  on  most  transport  category  aircraft.  As  shown, 
there  was  only  a  marginal  increase  in  the  burn-through  resis¬ 
tance  offered  by  the  three  inch  Microlite  material  (1  minute  32 
seconds  versus  1  minute  24  seconds  using  a  7.62  cm  thickness 
of  Aerocor).  The  test  rig  burn-through  times  compared  favor¬ 
ably  with  past  tests  using  surplus  aircraft  (Webster,  1994) 
where  flame  penetration  was  observed  in  approximately  2 
minutes  30  seconds.  Assuming  that  the  sidewall  panels,  floor¬ 
ing,  and  cargo  liner  in  the  surplus  aircraft  likely  provided  an 
additional  minute  of  protection,  it  was  concluded  that  the 
mock-up  tests  were  a  reasonable  representation  of  actual  crash 
file  conditions. 

With  a  realistic  and  repeatable  test  condition  and  the  burn- 
through  resistance  of  current  materials  defined,  improvements 
in  burn-through  resistance  were  evaluated.  Considering  the 
thermal  acoustical  insulation  system  only,  there  are  two  dis¬ 
tinct  possibilities:  1)  modification/enhancement  of  existing 
insulation  materials  and  2)  replacement  of  the  current  fiber¬ 
glass  insulation  with  a  more  fire  resistant  type. 


Evaluation  of  Modified 
Current  Insulation  Materials 

The  previous  burn-through  evaluation  of  existing  materials 
revealed  that  the  metallized  polyvinylfluoride  film  allowed 
rapid  fire  propagation  from  the  out-board  face  of  the  insulation 
bat  to  the  in-board  face.  A  candidate  replacement  film  is 
polyimide  (Kapton)  which  has  low  flammability/smoke  emis¬ 
sion  characteristics.  The  use  of  polyimide  or  Kapton  film  as  a 
moisture  barrier  for  commercial  aircraft  insulation  is  not  new, 
having  been  introduced  on  the  L- 1011.  The  Kapton  film  ex¬ 
hibited  improved  flame  resistance  as  shown  in  Figure  3.  For 
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Figure  3.  Fuselage  burn-through  resistance  improvements  with  cur¬ 
rent  fiberglass  insulation. 
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example,  comparable  burn-through  times  were  exhibited  when 
Kapton  was  used  with  half  the  thickness  of  insulation  (3.81  cm 
[  1.5  inches]  as  compared  to  7.62  cm  [3  inches]  of  insulation 
with  polyvinylfluoride.  Figure  2).  The  most  notable  test  results 
occurred  when  7.62  cm  (3  inch  thick)  Microlite  AA  was  used 
in  conjunction  with  the  Kapton  film.  This  combination  was 
capable  of  resisting  burn-through  for  four  minutes,  or  an 
increase  of  approximately  2  minutes  30  seconds  over  the 
identical  thickness  of  insulation  material  with  the  poly¬ 
vinylfluoride  film. 

A  thin  fire  resistant  layer  of  ceramic  fiber  material  known  as 
Nextel™  was  also  evaluated.  Developed  by  the  3M  Company, 
Nextel™  ceramic  oxide  fibers  are  continuous,  polycrystalline 
metal  oxide  fibers  suitable  for  producing  textiles  without  the 
aid  of  other  fiber  or  metal  inserts.  The  polycrystalline  fibers 
are  typically  transparent,  nonporous,  and  have  a  diameter  of 
1 0- 1 2  pm.  The  continuous  nature  and  flexibility  of  the  ceramic 
oxide  fibers  allows  them  to  be  processed  into  a  variety  of 
textile  shapes  and  forms  using  conventional  weaving  and 
braiding  processes  and  equipment.  In  this  particular  arrange¬ 
ment,  a  nonwoven  mat  of  Nextel™  was  being  tested  full-scale 
to  determine  its  effectiveness  when  used  as  an  additional 
barrier  to  the  existing  insulation. 

During  the  test,  the  Nextel™  was  placed  inside  each  of  the 
insulation  bats  and  then  encapsulated  with  the  standard  poly¬ 
vinylfluoride  moisture  barrier  film.  The  Nextel™  was  installed 
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on  the  out-board  face  of  the  insulation  bats  (within  the  film)  to 
form  a  flame  propagation  barrier  between  the  external  flames 
and  the  interior  of  the  fuselage.  The  insulation  bats,  along  with 
Nextel™  fiber  were  clamped  in  place  around  the  perimeter;  the 
clamping  also  held  the  Nextel™  in  place.  This  arrangement 
was  very  effective,  preventing  bum-through  for  nearly  seven 
minutes;  although  there  were  visible  flames  on  the  backface  of 
the  insulation  bats,  it  was  difficult  to  determine  what  was 
igniting  due  to  the  elevated  temperatures  (Figure  3).  A  majority 
of  the  Nextel™  was  revealed  to  have  remained  in  place  follow¬ 
ing  a  post  test  inspection,  however,  in  several  areas  it  was  clear 
that  the  Nextel™  had  opened,  allowing  flames  to  penetrate. 

Evaluation  of  Alternative  Insulation  Materials 

Another  series  of  tests  were  conducted  using  an  alternate 
insulation  material  known  as  Curlon  ,  a  heat  treated,  oxidized, 
polyacrylonitrile  fiber  (OPF)  produced  by  RK  Carbon  Inter- 
national,  Ltd.  Curlon  has  a  permanent  crimp  or  waviness 
incorporated  into  the  fiber  which  aids  in  the  manufacture  of 
lightweight  battings  used  primarily  for  aircraft  insulation.  RK 
Carbon  International  manufactures  the  OPF  (Panox  )  which 
is  then  converted  in  a  proprietary  heat  treating  process  to  form 
the  non-melting,  non-burning  gray-black  Curlon  fiber.  Cur- 
Ion  contains  about  70  percent  carbon,  20  percent  nitrogen, 
and  10  percent  oxygen.  It  has  a  diameter  of  about  8  microns 
and  is  considered  non-irritating  to  the  skin.  Curlon  is  also  a 
nonconductor  and  chemically  resistant. 

The  insulation  system  incorporating  Curlon®  is  marketed  by 
Orcon  Corp.  under  the  tradename  Orcobloc™,  formerly  FB- 
300,  and  is  unique  in  that  it  could  potentially  be  used  as  a 
drop-in  replacement  for  the  current  fiberglass  insulation  (i.e., 
it  possesses  qualities  similar  to  fiberglass  for  the  intended  use 
in  aircraft  applications).  Early  versions  of  the  FB-300  were 
somewhat  inferior  to  the  current  fiberglass  materials  in  terms 
of  sound  absorption  and  noise  attenuation,  which  is  the  pri¬ 
mary  purpose  of  insulation  in  the  window  belt  area.  The 
fabrication  process  was  altered  slightly  to  produce  a  better 
performing  material  known  as  FB-300  SA  (superior  acous¬ 
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Figure  4.  Fuselage  burn-through  resistance  Curlon®  insulation. 


tics).  Both  materials  were  tested  extensively  in  the  full-scale 
test  rig;  the  results  are  shown  in  Figure  4.  The  Curlon  material 
was  extremely  effective  at  resisting  flame  penetration  for  at 
least  five  minutes  during  several  tests.  Early  concerns  over  the 
decomposition  products  yielded  when  Curlon®  is  exposed  to 
elevated  temperatures  were  dispelled,  as  only  trace  amounts  of 
hydrogen  cyanide  were  collected  during  several  of  the  tests. 

The  performance  of  the  polyvinylfluoride  film  moisture 
barriers  was  also  more  evident  during  these  tests  since  the 
Curlon®  material  stayed  in  place  for  extended  periods  of  time. 
In  doing  so,  it  was  clear  that  the  fire  was  actually  propagating 
along  the  thin  film,  around  the  periphery  of  the  individual  bats 
to  the  back  face.  This  could  present  a  problem  when  interior 
sidewall  panels  are  installed  since  the  burning  film  may  be 
enough  of  an  ignition  source  to  involve  the  panels  despite  the 
fact  that  the  insulation  had  not  been  penetrated.  Two  additional 
tests  were  conducted  using  Kapton  film  with  the  Curlon  for 
an  additional  improvement.  The  backface  of  the  Kapton  film 
did  not  ignite  and  was  clearly  far  superior  to  the  poly¬ 
vinylfluoride  film  in  this  respect. 

Another  alternate  material  tested  was  a  rigid  polyimide  foam 
supplied  by  the  Imi-Tech  Corp.  known  as  Solimide  AC- 
430.  AC-430  has  excellent  sound  absorption,  and  good  thermal 
insulating  properties,  but  does  not  compress  like  fibrous  insu¬ 
lation,  allowing  superior  R-values  to  be  achieved.  The  primary 
advantage  of  the  foam  is  its  rigidity,  enabling  the  design  of  an 
insulation  system  which  spans  between  aluminum  formers 
(i.e.,  it  does  not  allow  the  insulation  to  directly  contact  the 
inside  surface  of  the  outer  skin)  thereby  reducing  moisture 
entrapment  from  condensation.  This  has  been  a  significant 
problem  with  existing  insulation  systems  as  they  inevitably 
absorb  moisture  when  in  continuous  contact  with  the  alumi¬ 
num  skin.  Variants  of  this  product  are  currently  in  use  in  the 
belly  area  of  some  newer  Boeing  commercial  aircraft.  As 
shown  in  Figure  5,  three  tests  were  run  using  rigid  polyimide 
foam  as  the  base  material. 

During  the  first  test,  insulation  bats  comprised  of  7.62  cm  (3 
inch)  of  Solimide  rigid  foam  heat  sealed  in  a  bag  of  Insulfab 
reinforced  polyimide  film  supplied  by  Facile  Holdings,  Inc. 


Figure  5.  Fuselage  burn-through  resistance  polyimide  foam  insula¬ 
tion. 
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Table  I.  Burn-Through  Material  Properties 


Insulation  Batting  Materials 

Material  Name 

Material  Type 

Density  (kg/m3) 

Density  (lb/ft3) 

Fiber  Diameter  (pm) 

Tensile  Strength  (GPa) 

AerocorType  PFI05WL 

Glass  Fiber 

6.7 

.  0.42 

1.5 

— 

Microlite  AA 

Glass  Fiber 

5.5  to  9.6 

0.34  to  0.60 

1.5 

Curlon® 

Heat  Treated,  Oxidized, 
Polyacrylonitrile  Fiber 

3.2  to  6.4 

3.2  to  6.4 

8 

0.65 

Solimide® 

Right  Polyimide  Foam 

5.3 

5.3 

n/a 

4  x  10‘5 

Fire  Barriers 

Nextel™ 

Ceramic  Fiber 

2,700 

168 

10  to  12 

1.7 

Quartzel® 

Vitrous  Silica  Wool 

17 

1.1 

9 

— 

Astroquartz  II® 

Quartz  Fabric 

890 

56 

9 

6.0 

Insulation  Films 

Material  Name 

Material  Type 

Film  Thickness  (pm) 

Skrim  Material 

Film  +  Skrim  Weigth  (g/m2) 

Tensile  Strength  (GPa) 

AN- 1  SR 

Metallized  Polyvinyl 
Flouride  Film 

50 

Nylon 

30  +  5 

KN-80 

Polyimide  (Kapton)  Film 

25 

Nylon 

46.5 

Insulfab  121-KP 

Polyimide  (Kapton)  Film 

25 

Nylon 

68.6 

— 

were  installed.  The  insulation  system  allowed  bum-through  to 
occur  at  1  minute  8  seconds,  approximately  20  seconds  less 
than  fiberglass  batting.  In  an  effort  to  extend  the  burn-through 
time,  Quartzel  ,  a  vitreous  silica  wool  barrier,  was  placed  in 
the  insulation  bats,  not  unlike  the  earlier  fiberglass  enhanced 
tests  with  Nextel™.  The  use  of  the  Quartzel®  improved  the 
burn-through  resistance  of  the  rigid  foam  material,  but  the 
system  was  still  much  less  effective  than  both  the  Nextel™ 
enhanced  fiberglass  system  and  the  Curlon®.  The  weakness 
appeared  to  be  at  the  seam  location,  which  allowed  flames  to 
propagate  to  the  in-board  face  early  in  the  test.  After  reinspec¬ 
tion  of  the  video  coverage,  it  was  determined  that  the  system 
was,  in  fact,  failing  at  the  seam,  rather  than  because  of  bum- 
through  of  the  material.  In  an  effort  to  rectify  the  problem, 
horizontal  “cap  strips”  were  used  in  addition  to  the  vertical  cap 
strips  already  used  in  the  previous  tests  to  hold  the  insulation 
to  the  test  frame.  A  third  test  was  conducted  with  this  arrange¬ 
ment  and  the  use  of  another  fire  blocking  material  known  as 
Astroquartz  11°,  a  quartz  fabric.  The  additional  horizontal  cap 
strips  aided  in  extending  the  burn-through  time,  but,  it  was  still 
not  close  to  the  level  attained  by  the  other  systems.  A  future 
test  has  been  planned  to  repeat  the  third  test  using  an  installa¬ 
tion  that  would  allow  direct  attachment  of  the  fire  blocking 
material  to  the  test  frame,  similar  to  the  attachment  method 
used  during  the  Nextel™  enhanced  test.  Known  properties  of 

the  materials  used  in  the  full  scale  tests  are  included  in  Table 

L 
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Development  of  a  Medium  Scale  Test  Rig 


Much  of  the  research  on  fuselage  burn-through  was  a  joint 
effort  between  the  FAA  and  the  United  Kingdom  Civil  Avia¬ 
tion  Authority  (CAA).  In  particular,  the  FAA  was  responsible 
for  the  development  of  the  full-scale  test  apparatus  described 
above,  while  the  CAA  had  tasked  Darchem  Engineering  to 
develop  a  medium-scale  test  apparatus.  During  the  early  phase 
of  this  joint  research  program,  it  was  determined  that  the 
development  of  a  small  or  medium  scale  burn-through  test 
facility  could  be  beneficial  in  investigating  the  problem  of 
bum-through.  A  laboratory  test  facility  which  could  replicate 
the  full-scale  conditions  allows  for  quick  and  inexpensive 
testing  of  improved  materials  and/or  systems  and  also  serves 
as  a  screening  device  for  evaluating  new  materials  under 
consideration.  To  date,  Darchem  has  developed  the  testing 
apparatus  and  has  logged  hundreds  of  hours  of  testing  at  the 
Faverdale  Technology  Centre  (FTC)  in  Darlington.  The  me¬ 
dium  scale  facility  has  proven  to  be  an  effective  screening  tool 
for  materials  under  consideration  and  enables  new  protection 
systems  to  be  developed.  It  is  anticipated  that  the  apparatus 
will  compliment  research  conducted  in  the  FAA  full-scale  test 
rig  in  order  to  bring  about  improvements  in  the  burn-through 
resistance  of  fuselages. 


Conclusions 

Summary  of  Results 

From  the  results  of  the  initial  full-scale  surplus  aircraft  tests, 
as  well  as  the  several  series  of  tests  completed  in  the  burn- 
through  test  rig,  it  is  evident  that  the  aluminum  skin  provides 
30  to  60  seconds  of  protection  prior  to  melting  and,  sub¬ 
sequently,  allowing  flame  impingement  on  the  thermal-acous¬ 
tical  insulation.  The  aluminum  skin  currently  in  use  offers  little 
opportunity  for  fire  hardening  and  will  likely  be  used  in  next 
generation  aircraft  to  a  large  extent.  This  leaves  the  focus  of 
extending  the  bum-through  resistance  on  the  thermal-acousti¬ 
cal  insulation  and  the  floor/sidewall  panel  combination  and 
related  components.  Full-scale  fire  tests  have  shown  that  ap¬ 
preciable  gains  in  burn-through  resistance  can  be  achieved  by 
either  protecting  or  replacing  the  current  fiberglass  thermal 
acoustical  insulation.  As  shown  in  Figure  6,  using  a  Kapton 
film  bagging  material  in  place  of  the  current  polyvinylfluoride 
film  alone  may  provide  an  additional  three  minutes  of  protec¬ 
tion.  Also,  a  lightweight  ceramic  matt  placed  on  the  out-board 
face  of  the  fiberglass  insulation  prevented  burn-through  over 
a  nearly  seven  minute  test  duration.  The  most  effective  replace¬ 
ment  combination  was  a  heat  stabilized,  oxidized  polyacrilo- 
nitrile  fibrous  material  (Curlon®)  encased  in  a  polyimide  film. 
This  combination  resisted  burn-through  for  eight  minutes.  The 
Curlon  did  not  ignite  or  burn  when  subjected  to  the  fuel  fire. 
The  Kapton  film  prevented  any  flame  spread  on  the  in-board 
face.  Moreover,  the  Curlon®  has  the  ability  to  be  used  as  a 
direct  drop-in  replacement  for  the  currently  used  material. 


Future  Considerations 
Air  Return  Grilles 

Once  a  fire  penetrates  the  thermal  acoustical  insulation,  it  can 
quickly  gain  access  to  the  cabin  via  the  air  return  grill  system. 
The  use  of  intumescent  coatings  may  be  a  simple  concept  for 
delaying  grill  penetration  (and  could  be  used  for  the  enhance¬ 
ment  of  the  backface  of  interior  panels  to  prolong  their  burn- 
through  capabilities). 

Aluminum  Versus  Steel  Structure 

Although  the  enhanced  and  alternate  insulation  materials 
tested  produced  results  which  were  very  promising,  it  should 
be  noted  that  the  tests  may  be  biased  due  to  differences  between 
the  test  rig  and  an  actual  aircraft  fuselage.  The  most  significant 
is  the  use  of  a  steel  structure  in  the  test  rig,  which  will  not 
collapse  during  a  test.  For  this  reason,  tests  will  be  conducted 
with  actual  aircraft  structure  to  investigate  the  effect  of  the 
aluminum  structure  on  burn-through  resistance  improvement. 

Attachment  Methods 

In  conjunction  with  the  tests  using  aluminum  aircraft  struc¬ 
ture,  a  thorough  investigation  of  the  attachment  methods  will 
be  conducted.  The  method  of  attachment  is  critical  if  burn- 
through  resistance  improvements  are  to  be  realized.  It  may  be 
possible  to  obtain  several  minutes  additional  protection  from 
burn-through  using  current  materials  by  simply  using  attach¬ 
ment  clips  that  won’t  melt  and  fail  during  exposure  to  external 
fires.  Currently,  there  are  several  different  methods  of  insula¬ 
tion  bat  attachment,  most  of  which  consist  of  thermoplastic 
washer  type  fasteners.  In  addition,  many  of  the  current  insula¬ 
tion  bats  are  attached  directly  to  the  backface  of  the  fuselage 
skin  via  fasteners  mounted  using  pressure  sensitive  adhesives 
which  will  quickly  fail  when  heated  from  fuel  fire  exposure. 

Windows 

The  cabin  windows  must  also  be  protected  against  burn- 
through  by  an  external  fuel  fire.  The  pressure  pane  located  on 
the  outermost  surface  is  constructed  of  stretched  acrylic  which 
shrinks  when  exposed  to  heat  and  flames.  Once  this  occurs,  the 
pressure  pane  falls  out  of  place,  allowing  the  flames  to  impinge 
on  the  fail-safe  pane  which  will  similarly  fail  in  short  duration. 
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Airframe  manufacturers  would  be  reluctant  to  modify  the 
pressure  pane;  however,  it  is  possible  that  the  fail  safe  pane 
could  be  enhanced  to  contribute  to  the  improved  fire  resistance 
of  the  aircraft  fuselage. 

Totally  Composite  Fuselage 

Another  area  that  will  be  studied  is  the  burn-through  resis- 
lance  of  a  composite  skin  fuselage.  The  use  of  composites  in 
transport  category  aircraft  has  grown  steadily  due  to  their  high 
strength  and  low  weight.  The  fuselage  skin  of  the  High  Speed 
Civil  Transport  (HSCT)  will  likely  be  constructed  of  a  com¬ 
posite  material  which  requires  an  assessment  of  its  perform¬ 
ance  when  exposed  to  a  large  fuel  fire.  From  a  burn-through 
standpoint,  a  composite  fuselage  would  likely  offer  greater 
burn-through  protection  than  aluminum.  However,  there  is 
concern  over  the  potential  for  toxic  and  combustible  gases 
being  released  during  flame  exposure,  which  could  present  a 
hazard  to  escaping  occupants.  Whether  or  not  this  is  a  real 
concern  will  be  determined  in  the  full-scale  test  rig  by  replac¬ 
ing  the  aluminum  skin  with  composite  structure  and  measuring 
the  resultant  gases  within  the  cabin. 
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Aircraft  Composite  Structures  ■ 


CARGO  FLOOR  PANEL 

•  Fiberglass/Epoxy/Aluminum 

•  Balsawood  Core 
CARGO  FLOOR  BEAM 

•  Stitched  Carbon  Fiber/Epoxy 

•  RTM  y 


VSCF  NOSE  SCOOP 

•  Fiberglass/Epoxy 

•  Integral  Deicing 


NOSE  STRAKE 

•  Fiberglass/Epoxy 

•  Integral  Deicing 


NACELLE 

•  Carbon  Fiber/Epoxy 

•  Aluminum  Honeycomb 


DESIGN 


PROTOTYPES 


PRODUCTION 


For  18  years  Composites  Horizons,  Inc.  (CHI)  has 
positioned  itself  at  the  leading  edge  of  Fiber 
Reinforced  Composite  Parts  Fabrication  lor  the 
aerospace  industry. 

'on9  *5een  ^cognized  as  a  leader  in  the  use 

or  nign  Temperature  Polyimide  and 
Thermoplastic  resin  systems. 


Recent  concerns  in  the  area  of  Aircraft  Deicing 
have  led  CHI  to  develop  a  process  lor  INTEGRAL 
DEICING  OF  COMPOSITE  STRUCTURES.  In 
conjunction  with  a  major  aircraft  controls  company, 
CHI  can  both  design  and  fabricate  Heated 
Composite  Fairings,  Scoops  and  Leading  Edges. 
Contact  CHI  (or  your  next  difficult  Composite  Design 
and  Fabrication  problem. 


£1 


COMPOSITES  HORIZONS,  INC. 

1471  INDUSTRIAL  PARK  STREET  COVINA,  CALIFORNIA  91722-3499 
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BEVELOIMHIT  OP  IMPROVED  PORE  SAFETY  STANDARDS 
ADOPTED  BY  THE  FEDERAL  AVIATION  ADMINISTRATION 

Constantine  P.  Sarkos 
Manager,  Fire  Safety  Branch 
Federal  Aviation  Administration  Technical  Center 
Atlantic  City  International  Airport,  NJ  08405 
U.S.A. 


SDMttRY 

This  paper  summarizes  a  series  of  improved  fire  safety  standards  for  transport  aircraft  adopted 
or  proposed  by  the  United  States  Federal  Aviation  Administration  over  the  past  five  years  and 
describes  the  technical  development  of  these  standards..  Important  test  results  and  analyses  employed 
to  develop  the  new  standards  are  described.  Reference  is  made  to  technical  publications  issued  by 
the  FAA  for  each  fire  safety  area.  Bnphasis  is  placed  on  recent  and  high-inpact  rulemaking  actions 
such  as  the  heat  release  standard  for  large  surface  area  interior  panels  (based  on  the  Ohio  State 
Rate-of -Heat-Release  Apparatus ) .  Other  activities  summarized  include  heat  resistance  evacuation 
slides,  smoke  detectors  and  fire  extinguishers,  cargo  compartment  fire  protection,  seat  cushion  fire 
blocking  layers,  floor  proximity  lighting,  and  crewmember  protective  breathing  equipment. 


IN1R0DCJCTICN 

The  Federal  Aviation  Administration  (FAA)  has  undertaken  an  unprecedented  series  of  regulatory 
actions  over  the  past  five  years  for  the  purpose  of  improving  transport  aircraft  interior  fire 
safety.  These  initiatives  were  part  of  a  broad,  scheduled  program  to  enhance  airliner  safety  that 
includes  such  diverse  topics  as  water  survival,  child  restraints,  and  crashworthiness  (1).  They  are 
a  culmination  of  a  number  of  factors,  including  advisory  committee  recommendations  (2), 
congressional  support,  product  oriented  FAA  technical  programs,  accident  pressures,  and  industry 
cooperation. 

Aircraft  interior  design  for  fire  safety  covers  three  broad  areas:  material  fire  test  methods, 
fire  management  and  suppression,  and  evacuation  and  survival.  Because  of  the  overriding  concern 
with  the  effect  of  the  hazards  of  burning  interior  materials  on  occupant  survivability,  the  FAA  has 
placed  greatest  emphasis  in  its  research,  engineering  and  development  program  for  cabin  fire  safety 
on  the  development  of  improved  fire  test  methods  for  interior  materials.  Products  from  this  program 
were  incorporated  into  new  fire  test  standards  for  seat  cushion  fire  blocking  layers  (5),  low 
heat/smoke  release  interior  panels  (4,5),  bumthrough  resistant  cargo  liners  (6),  and  radiant  heat 
resistant  evacuation  slides  (7)  •  New  requirements  for  detectors  and  extinguishers  (8)  will  improve 
in-flight  fire  management  and  suppression.  Evacuation  and  survival  has  been  enhanced  by  new 
standards  for  floor  proximity  lighting  (9)  and  flight  crewmember  fixed  protective  breathing 
equipment  and  cabin  crewmember  portable  protective  breathing  equipment  (10). 


seat  cushion  fire  blocking  laybs 

Aircraft  seats  are  typically  constructed  of  fire  retardant  polyurethane  foam  and  upholstery 
fabric,  which  previously  was  required  to  pass  the  vertical  Bunsen  burner  test  prescribed  in  Federal 
Aviation  Regulation  (FAR)  25.853  (11).  However,  under  the  conditions  of  a  severe  cabin  fire,  the 
foam  core  ignites  readily  and  burns  rapidly,  significantly  contributing  to  the  spread  of  fire.  The 
concept  of  a  fire  blocking  layer  material  to  encapsulate  and  to  protect  the  polyurethane  foam  was 
recommended  for  evaluation  and  development  by  the  Special  Aviation  Fire  and  Explosion  Reduction 
(SAFER)  Advisory  Committee  (2). 

The  initial  phase  of  FAA  evaluation  consisted  of  a  series  of  full-scale  tests  to  determine  the 
effectiveness  of  the  seat  cushion  fire  blocking  layer  concept  under  the  conditions  of  an  intense 
postcrash  fuel  fire.  Prior  work  by  others  was  limited  to  the  evaluation  of  fire  blocking  layers 
under  moderate  fire  conditions  for  office,  theater,  institutional,  and  surface  transit  vehicle 
settings.  The  FAA  full-scale  tests  were  conducted  in  a  new  building  with  the  capability  of 
subjecting  aircraft  test  articles  to  large  jet  fuel  pool  fires  under  controlled  environmental 
conditions  (12).  A  C— 133  airplane  modified  to  resemble  a  wide  body  interior  was  employed  as  the  test 
article  (figure  1 ) .  Basically,  a  section  of  the  C-133  test  article  was  lined  and  furnished  with 
actual  cabin  materials  and  subjected  to  an  intense  external  fuel  fire  placed  adjacent  to  a  simulated 
fuselage  rupture.  The  results  of  four  tests  with  modified  seat  cushions  (13),  but  with  all  other 
test  aspects  identical,  are  shown  in  figure  2.  In  this  figure  the  fractional  effective  dose  (FED) 
accounts  for  the  assumed  additive  effect  of  measured  levels  of  toxic  gases  and  elevated  temperature 
on  survival  (12).  An  FED  value  of  unity  corresponds  to  incapacitation  and  indicates  the  hypothetical 
survival  tine.  The  additional  time  available  for  escape  when  the  seats  were  protected  with  Vonar™ 
and  Norfab™  fire  blocking  layers  was  60  and  43  seconds,  respectively,  and  was  comparable  in  the  case 
of  Vonar  to  the  safety  benefits  provided  by  noncombustible  foam  cushions.  Further  testing 
demonstrated  that  blocking  layers  could  provide  even  greater  improvements  against  certain  types  of 
ramp  and  in-flight  fires,  for  example,  preventing  fires  that  may  otherwise  become  out  of  control  when 
initiated  at  an  unprotected  seat  and  left  unattended  (14).  Although  these  data  demonstrate  the 
efficacy^ of  the  fire  blocking  layer  concept,  extensive  additional  FAA  work  was  needed  to  make  the 
concept  into  a  viable  product .  This  additional  work  covered  the  subjects  of  weight  optimization  and 
durability  (15),  flotation  (16),  cost-effectiveness  (17),  and  certification  testing  of  cushions  (18). 
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The  final  rule  established  that  transport  aircraft  seat  cushions  meet  new  and  more  severe 
fl  amiability  requirements  by  November  26,  1987  (3).  The  new  test  methodology,  developed  by  FA  A, 
subjects  seat  back  and  seat  bottom  cushion  specimens  to  a  burner  with  temperature  and  heat  flux 
typical  of  a  cabin  fire  (figure  3).  Unlike  most  flammability  tests,  the  test  specimens  simulate  the 
end  use  seat  configuration  and  allow  for  the  burning  interaction  of  upholstery  cover,  fire  blocking 
layer,  and  foam  cushion.  In  addition,  other  important  effects  such  as  seat  construction  features 
(thickness,  seams,  foam  layering,  etc.)  and  the  melting,  dripping,  and  pool  burning  behavior  of 
urethane  foam  are  taken  into  consideration.  Acceptance  criteria  consist  of  10  percent  weight  loss 
and  a  bum  length  of  17  inches  -  performance  essentially  matching  that  attained  by  the  Vonar®  and 
Norfab®'-  blocking  layer  materials  proven  effective  in  full-scale  tests.  An  advisory  circular  was 
issued  by  FAA  to  provide  guidance  material  for  testing  seat  cushions  to  show  compliance  with  the  rule 
(19). 


Approximately  350  fire  blocking  layer  materials  were  evaluated  by  FAA  following  the  development 
of  the  seat  cushion  flammability  test  methodology.  About  130  materials  met  the  performance  criteria, 
including,  for  example,  thin  foams,  fiberglass  cloths,  aluminized  fabrics,  and  graphitized  fabrics, 
demonstrating  the  availability  of  suitable  fire  blockers.  Many  of  the  materials  later  proved  to  be 
impractical  from  weight,  comfort,  and  durability  considerations  upon  subsequent  indepth  evaluation  by 
seat  manufacturers.  Today,  the  majority  of  seats  manufactured  in  the  United  States  are  constructed 
of  either  polybenzimidazole  felts  or  aramid  fire  resistant  quilts,  weighing  6  to  10  ounces  per  square 
yard.  The  entire  United  States  airline  fleet,  consisting  of  approximately  650,000  seats,  is 
protected  with  seat  cushion  fire  blocking  layers. 


LCW  HEAT  RELEASE  INTERIOR  PANELS 

The  interior  panels  of  an  aircraft  cabin,  such  as  the  sidewalls,  ceiling,  stowage  bins,  and 
partitions,  are  very  important  to  the  cabin  fire  load  because  of  their  large  surface  area  and,  in 
some  cases,  location  in  the  upper  cabin  where  fire  tenperatures  are  greatest.  This  importance  was 
evidenced  in  the  full-scale  fire  tests  with  fire  blocking  layers  (figure  2).  In  the  test  with 
noncombustible  seat  cushions,  the  flashover  was  caused  primarily  by  the  burning  panels.  Interior 
panels  are  usually  complex  composites  consisting  generally  of  a  Nomex™  honeycomb  core,  resin- 
inpregnated  fiberglass  facings,  and  a  decorative  laminate  finish. 

The  next  logical  step  in  fire-hardening  the  interior  of  a  transport  aircraft,  after  the 
establishment  of  a  seat  cushion  flammability  standard  (3),  was  to  improve  the  fire  performance  of  the 
interior  panels  by  development  of  more  stringent  and  new  fire  test  requirements.  The  issue  of 
improved  test  methodology  was  complicated  by  the  requirement  to  consider  the  interrelated  concerns  of 
flammability,  smoke,  and  toxicity.  However,  test  methodology  development  was  preceded  by  the  need  to 
document  (by  full-scale  fire  tests)  the  potential  benefits  of  fire-hardened  panels  for  several  fire 
scenarios. 

The  potential  for  improved  safety  was  examined  in  the  C— 133  wide  body  test  article  used  earlier 
for  evaluation  of  the  effectiveness  of  seat  cushion  fire  blocking  layers.  A  section  of  the  test 
article  was  fitted  with  sidewalls,  stowage  bins,  a  ceiling,  and  a  partition,  each  constructed  of  an 
advanced  composite  panel  selected  by  the  National  Aeronautics  and  Space  Administration  (NASA),  as 
well  as  fire  blocked  seats  and  carpet,  and  subjected  to  three  types  of  full-scale  fire  conditions. 

The  same  tests  were  repeated  with  a  panel  design  used  extensively  in  early  wide  body  interiors  and 
still  retained  for  some  interior  applications.  The  safety  improvement  associated  with  the  advanced 
panel  when  compared  to  the  in-service  panel  was  significant.  With  the  advanced  panel,  flashover  was 
actually  prevented  when  the  external  fuel  fire  was  adjacent  to  a  door  opening  or  when  an  in-flight 
fire  was  started  from  a  gasoline  drenched  seat.  In  the  more  severe  ruptured  fuselage  scenario, 
therein  seats  are  more  directly  exposed  to  the  external  fuel  fire,  use  of  advanced  panels  resulted  in 
a  2-minute  delay  to  the  onset  of  flashover  (20). 

The  full-scale  fire  tests  in  the  C-133  wide  body  test  article,  conducted  to  examine  the  benefits 
of  seat  cushion  fire  blocking  layers  and  fire-hardened  interior  panels,  demonstrated  that  occupant 
survivability  was  largely  driven  by  cabin  flashover.  Flashover  may  be  defined  as  the  sudden  and 
rapid  uncontrolled  growth  of  fire  from  a  relatively  small  area  surrounding  the  ignition  source  to  the 
remainder  of  the  cabin.  Typical  C-133  test  data  exhibiting  this  behavior  are  shown  in  figure  4. 
Before  the  onset  of  flashover,  which  occurred  at  about  150  seconds,  the  smoke  and  toxic  gas  levels 
were  minimal  and  survival  was  clearly  possible.  After  the  onset  of  flashover,  smoke  and  toxic  gas  - 
levels  and  temperature  increased  rapidly  to  a  level  that  would  have  made  survival  highly  unlikely. 

It  should  be  noted  that  flashover  is  a  phenomenon  that  generally  occurs  when  fire  in  an 
enclosure  generates  heat  at  seme  critical  rate  that  is  effected  by  heat  transfer  and  ventilation. 
Flashover  to  a  large  degree  is  caused  by  the  heat  release  rate  of  burning  interior  materials.  Thus, 
a  rate  of  heat  release  test  methodology  will  tend  to  yield  the  contribution  of  a  given  material  to 
the  flashover  event.  Also,  selection  of  interior  materials  on  the  basis  of  minimizing  heat  release 
rate  also  serves  to  implicitly  reduce  the  cabin  smoke  and  toxic  gases  hazards  since  it  is  the 
flashover  event  that  generates  hazardous  quantities  of  combustion  products  (figure  4). 

Several  studies  were  conducted  to  correlate  the  performance  of  conposite  panels  in  a  heat 
release  test  device  and  under  realistic  cabin  fire  conditions.  Initially,  a  variety  of  laboratory 
flammability  tests  were  evaluated  in  terms  of  panel  performance  with  results  in  a  1 /4-scale  cabin 
model  (21).  The  Ohio  State  University  (0SLJ)  rate-of-heat-release  apparatus  exhibited  the  best 
correlation  with  model  fire  test  results.  Although  probably  any  of  the  available  heat  release  rate 
tests  would  serve  to  yield  the  flashover  potential  of  various  panel  materials,  the  OSH  apparatus  was 
selected  specifically  for  further  evaluation  and  development.  The  decision  to  select  the  OSH 
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apparatus  was  based  on  the  above  correlation  study  as  well  as  recommendations  of  the  SAFER  committee 
(2),  the  use  of  the  OStT  apparatus  in  the  development  of  the  Combined  Hazard  Index  (22),  the 
availability  of  the  OSU  apparatus  with  the  airframe  manufacturers  and  its  standardization  by  the 
American  Society  of  Testing  and  Materials  (ASM) .  A  second  study  corroborated  the  earlier  good 
correlation  results  in  that  it  established  an  inverse  relationship  between  heat  release  measurements 
in  the  OSU  apparatus  and  the  time-to-flashover  of  a  series  of  composite  panels  evaluated  in  the  full- 
scale  C— 133  test  article  under  postcrash  fire  conditions  (23). 

The  second  correlation  study  involved  C— 133  tests  of  five  composite  panel  constructions  under  a 
scenario  consisting  of  an  external  fuel  fire  adjacent  to  an  open  door.  To  realistically  evaluate 
panel  performance,  the  flat  panel  test  specimens  were  installed  in  a  typical  configuration  that 
included  sidewalls,  stowage  bins,  a  ceiling  and  partitions  (figure  5).  In  this  arrangement,  other 
factors  such  as  ease  of  ignition  and  flame  spread  rate  for  the  panels,  as  well  as  the  contribution  of 
fire-blocked  seats  and  carpet,  were  allowed  to  come  into  play.  The  results  of  these  tests  are  shown 
in  figure  6  as  an  FEB  history  plot.  The  graph  indicates  a  wide  range  in  behavior  for  the  five  types 
of  panels.  The  phenolic/Kevlar™  and  epoxy /fiberglass  panels  displayed  the  earliest  flashovers, 
whereas  the  phenolic/fiberglass  panel  delayed  flashover  by  about  3  minutes.  Moreover,  there  was  a 
monotonic,  inverse  relationship  between  heat  release  measured  by  the  OSU  apparatus  and  time  to 
flashover.  Also,  the  data  indicate  that  small  changes  in  heat  release  by  materials  may  result  in 
large  changes  in  the  time  to  cabin  flashover. 

The  actual  criteria  for  material  selection  were  driven  by  the  level  of  benefits  evidenced  by 
full-scale  testing.  The  phenolic/fiberglass  panel  tested  well  under  virtually  any  test  condition 
(23),  and  this  construction  was  achievable  by  state-of-the-art  manufacturing  processes.  Thus,  the 
phenolic/fiberglass  panel  was  used  as  a  benchmark  for  selection  of  the  performance  criteria  for  OSU 
testing  of  panel  materials.  A  pass/fail  criterion  of  65  kw-min/m2  for  a  2-minute  total  heat  release 
was  selected  to  embrace  the  performance  of  the  phenolic/fiberglass  panel.  An  additional  criterion  of 
65  kw/m2  for  peak  heat  release  rate  was  included  to  eliminate  usage  of  those  materials  that  bum 
rapidly  but  produce  small  quantities  of  heat  because  of  their  low  weight.  The  final  rule  also, 
contains  a  new  requirement  for  smoke  emission  testing  in  order  to  minimize  the  possibility  that 
emergency  egress  will  be  hampered  by  smoke  obscuration  (5) . 

A  schematic  of  the  OSU  apparatus  is  shown  in  figure  7-  The  equipment  is  basically  a  flowthrough 
device  that  measures  the  heat  release  rate  as  a  function  of  time  by  a  material  subjected  to  a  preset 
level  of  irradiated  heat.  Although  the  relationship  between  heat  release  rate  data  measured  by  the 
OSU  apparatus  and  cabin  fire  conditions  was  demonstrated,  the  OSU  data  have  been  found  to  be 
sensitive  to  certain  design  features  and  operational  conditions.  Three  round-robin  test  programs 
between  FA A  and  the  United  States  Aerospace  Industries  Association  (AIA)  were  necessary  to  reduce  the 
reproducibility  of  data  between  laboratories  to  an  acceptable  level  (24).  Results  from  the  third 
round  robin,  with  Boeing,  Douglas,  OSU,  and  FAA  as  participants,  however,  indicate  that  consistent 
results  are  attainable  (figure  8).  For  example,  the  reproducibility  of  the  third  round  robin,  as 
measured  by  the  percentage  average  relative  standard  deviation,  was  7.7  and  7.8  percent  for  total 
heat  release  and  peak  heat  release  rate,  respectively  (24).  Moreover,  in  a  more  recent  round  robin 
involving  FAA  and  four  laboratories  in  Ehrope,  the  reproducibility  was  quite  acceptable  after  the 
initial  comparison  -  5-4  and  10.9  percent  for  total  and  peak  measurements,  respectively. 


CAH30  LINER  BURNTHROUGH  RESISTANCE; 

lower  cargo  compartments  in  large  transport  aircraft  are  categorized  as  either  class  C  or  class 
D  types  (11).  The  latter  are  small  compartments  designed  for  fire  containment  by  oxygen  starvation, 
while  the  former  are  larger  compartments  that  are  required  to  have  a  fire  detection  and  suppression 
system.  FAA  conducted  full-scale  fire  tests  to  investigate  the  resistance  of  cargo  liners  to  flame 
penetration  for  both  compartment  classifications.  In  a  class  D  compartment,  where  it  is  critical 
that  liners  not  be  breached  in  order  to  allow  oxygen  starvation  to  take  place,  it  was  found  that  some 
types  of  liners  failed  (25).  Fiberglass  liners  resisted  bumthrough,  whereas  Nomex  liners  were 
penetrated  by  the  flames  (figure  9).  It  was  concluded  that  a  class  D  cargo  fire  was  controllable  if 
fiberglass  or  equivalent  were  the  liner  materials;  but,  if  Nomex  were  used,  the  fire  would  continue 
to  burn  because  of  the  availability  of  oxygen  due  to  liner  failure .  In  tests  conducted  inside  a 
class  C  cargo  compartment,  even  with  a  detection/suppression  system,  liner  bumthrough  resistance 
equivalent  to  fiberglass  was  required  to  ensure  fire  suppression  under  all  scenarios  (26) .  For 
example ,  Kevlar  liner  bumthrough  occurred  when  sudden,  intense  flaming  fires  were  employed  and  when 
a  time  lapse  was  allowed  between  the  points  of  detection  and  discharge  of  suppression  agent. 

Although  the  fire  may  be  suppressed  by  the  agent,  it  was  determined  that  the  breached  cargo  liner 
would  cause  a  more  rapid  depletion  of  agent  concentration  and  re-ignition  at  an  earlier  point  in  time 
than  in  an  intact  compartment.  The  main  conclusion  from  the  testing  was  that  a  more  realistic  and 
severe  test  requirement  was  needed  for  cargo  liners  used  in  both  class  C  and  class  D  cargo 
compartments. 

A  new  fire  test  method  that  measures  the  bumthrough  resistance  of  cargo  liners,  shown  in  figure 
10,  was  developed  with  the  features  of  severe  liner  exposure  (matching  the  maximum  heat  flux  and 
temperature  measured  during  full-scale  tests)  and  realistic  ceiling  and  sidewall  liner  orientation 
(27).  This  test  method  is  the  basis  for  more  stringent  test  requirements  in  newly  certified  aircraft 
(6)  and  a  similar  proposal  for  certain  transports  now  in  service  (28).  Criteria  for  acceptance  are 
that  there  must  be  no  flame  penetration  of  ceiling  and  sidewall  specimens  and  that  the  temperature 
measured  above  the  ceiling  specimen  must  not  exceed  400  °F.  The  flame  penetration  criterion  can  be 
met  by  fiberglass  liners  but  not  by  Nomex  or  Kevlar  liners  (27).  However,  many  fiberglass  liners 
cannot  meet  the  peak  temperature  criterion  because  of  the  type  or  weight  of  resin  and  type  of  cloth 
weave  (29) .  It  appears  that  fiberglass  suitably  tailored  to  meet  the  peak  temperature  criterion  will 
be  the  material  of  choice  for  new  bumthrough  resistance  requirements  although  several  new  materials 
or  combinations  are  being  studied. 
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In  a  more  recent,  separate  action,  the  FAA  has  proposed  a  new  airworthiness  directive  (AD)  for 
"combi"  airplanes  certified  with  a  main  deck  class  B  cargo  compartment  (30).  Ibis  action  was 
prompted  by  the  loss  of  a  747  airplane  that  apparently  developed  a  major  fire  in  the  main  deck  cargo 
compartment .  The  AD  proposes  design  changes  that  would  require  that  the  class  B  compartments  be 
modified  to  a  class  C  configuration  or  that  bumthrough  resistant  cargo  containers,  meeting  the  more 
stringent  test  requirements  for  cargo  liners  (6)  and  employing  smoke  detection  and  extinguishing 
systems,  be  used  to  carry  all  cargo. 


RADIANT  HEAT  RESISTANT  EVACUATION  SLIDES 

In  1978,  a  DC-10  experienced  an  aborted  takeoff  resulting  in  a  major  jet  fuel  fire  and  the 
resultant  collapse  of  a  deployed  evacuation  slide  caused  by  radiant  heat  damage.  Although  the  two 
fatalities  were  not  attributable  to  loss  of  the  slide  for  emergency  egress,  the  PAA  undertook  a  test 
and  development  program  to  improve  the  radiant  heat  resistance  of  slide  fabrics.  From  a  series  of 
full-scale  fire  tests  in  which  pressurized  slides  were  subjected,  at  various  distances,  to  a  30- 
foot-square  fuel  fire,  it  was  determined  how  slides  failed  and  the  time  duration  for  failure  (loss  of 
pressurization)  to  occur  (31).  For  example,  a  typical  urethane  nylon  slide,  located  15  feet  from  the 
edge  of  the  fuel  fire,  where  the  irradiance  was  1.5  Btu/ft 2-sec,  failed  in  25-30  seconds  on  the  plain 
surface  (non-seam  area).  Also,  it  was  shown  that  an  aluminized  reflective  coating  significantly 
improved  the  airholding  qualities.  The  uncoated  urethane  nylon  slide  that  failed  in  25-30  seconds 
held  pressure  for  70-75  seconds  when  protected  with  an  aluminized  coating  and  loss  in  pressure 
occurred  at  an  opened  seam. 

To  permit  the  development  and  qualification  of  improved  slide  fabrics,  a  laboratory  test  was 
developed  (31).  The  essential  features  of  the  laboratory  test,  shown  in  figure  11,  are  a  radiant 
heater,  calorimeter,  pressure  holding  cylinder,  specimen  holder,  pressure  gage,  pressure  transducer, 
and  recording  device.  Basically,  a  slide  fabric  specimen  is  mounted  to  the  pressure  holding  cylinder 
which  is  then  pressurized.  The  irradiance  to  the  specimen  is  set  by  the  calorimeter.  Pressure 
holding  capability  of  the  specimen  at  the  set  irradiance  level  is  determined  by  the  recorded  pressure 
history. 

On  June  3,  1983>  FA A  issued  Technical  Standard  Order  (TS0)-C69a,  Emergency  Evacuation  Slides, 
Ramps,  and  Slide/Raft  Combinations,  which  made  general  improvements  to  the  equipment  requirements  and 
contained  new  requirements  for  radiant  heat  resistance  (7).  TS0-C69a  required  that  all  evacuation 
slides  purchased  after  December  3,  1984,  meet  the  new  standards.  For  radiant  heat  resistance,  the 
requirement  is  retention  of  pressure  for  90  seconds  at  an  irradiance  of  1.5  Btu/ft2-sec.  The 
pressure  holding  members  of  all  TSO-approved  inflatable  evacuation  slides  are  now  constructed  of 
aluminized  materials  in  order  to  provide  adequate  radiant  heat  resistance. 


SMCKE;  DETECTORS  AND  fiKE  kxt  i  ritjU  1  Shkhfci 

As  the  result  of  investigations  of  in-flight  fires,  including  the  Air  Canada  DC-9  on  June  2, 
1983,  (that  resulted  in  23  fatalities)  and  an  inspection  survey  of  the  United  States  air  carrier 
fleet,  the  FA A  amended  the  FARs  with  the  following  requirements:  a  smoke  detector  in  each  lavatory, 
an  automatic  fire  extinguisher  in  each  lavatory  trash  receptacle,  increased  number  of  hand  fire 
extinguishers,  and  the  use  of  Halon  1211,  or  equivalent,  as  the  extinguishing  agent  in  at  least  two 
of  the  hand  fire  extinguishers  (8).  A  separate  time  period  was  specified  for  implementation  of  each 
requirement,  with  the  longest  period  extending  to  April  29,  1986. 

FAA  supportive  experimental  and  analytical  studies  for  these  amended  regulations  have 
concentrated  on  the  effectiveness  and  safety  of  Halon  1211  (bromoohlorodifluoromethane)  hand 
extinguishers.  Initial  tests  showed  the  superiority  of  Halon  1211  in  knockdown  and  extinguishment 
capability  against  fuel  drenched  seat  fires  in  comparison  to  water,  dry  chemical,  and  carbon  dioxide 
extinguishers.  However,  opposition  to  the  usage  of  Halon  1211  centered  on  the  toxicity  associated 
with  the  agent  and,  in  particular,  its  decomposition  products.  Subsequent  tests  by  the  FAA  clearly 
showed  that  virgin  agent  and  decomposition  gas  concentrations  peaked  at  levels  significantly  below 
values  considered  dangerous  and  rapidly  dissipated  due  to  the  effect  of  adsorption,  stratification, 
dilution,  and  ventilation  (32).  Topical  gas  profiles  measured  near  an  extinguished  seat  fire  in  the 
C-133  test  article  are  shown  in  figure  12.  Hydrogen  fluoride  (HF)  and  hydrogen  bromide  (HBr) 
concentrations  peaked  at  about  10  parts  per  million  (ppm),  hydrogen  chloride  (HC1)  peaked  at  17  ppm, 
and  the  peak  virgin  agent  concentration  was  1800  ppm  (0.18  percent).  Most  importantly,  it  became 
evident  that  the  hazards  associated  with  an  uncontrolled  seat  fire  would  quickly  surpass  those 
transient  hazards  resulting  from  Halon  1211  decomposition  (32)  and  would  possibly  result  in  cabin 
flashover  within  3  to  4  minutes  if  left  unchecked  (13). 


To  place  a  conservative  upper  limit  on  the  quantity  of  agent  that  could  safely  be  discharged 
inside  a  compartment,  a  perfect  stirrer  model  was  used  to  analyze  the  decay  of  agent  concentration 
due  to  ventilation  (33).  Nomographs  developed  from  this  analysis  predict  maximum  safe  agent  weight 
for  a  given  compartment  volume  and  ventilation  rate  and  are  incorporated  in  a  revised  advisory 
circular  (AC)  on  hand  fire  extinguishers  (34). 

In  related  studies,  the  FAA  has  examined  the  safety  of  Halon  extinguishing  agent  discharge  in 
small  airplanes  (35 >56, 37).  A  major  concern  is  the  warning  label  on  Halon  bottles  against  discharge 
in  a  small  enclosure  volume.  For  exanple,  for  the  cournon  size  2  1/2  pound  Halon  1211  extinguisher, 
the  upper  volume  limit  for  "safe"  agent  discharge  is  312  cubic  feet.  However,  FAA  tests  conducted 
under  simulated  flight  conditions  in  a  Cessna  210  with  a  cabin  volume  of  140  cubic  feet  clearly 
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detpnstrated  that  both  Halon  1211  and  Halon  1301  could  he  safely  discharged  in  this  relatively  small 
airplane  cabin  (35,36).  The  absence  of  significant  concentrations  of  agent  near  a  seated  occupant 
was  shown  to  be  primarily  the  result  of  accumulation  of  the  heavy  agent  near  the  floor  and,  to  a 
lesser  degree,  high  cabin  ventilation  rates.  Apparently,  the  Halon  bottle  warning  labels  are  based 
on  safety  factors  for  human  exposure  as  well  as  assumptions  of  zero  ventilation  and  homogeneous  agent 
distribution.  Fire  tests  conducted  inside  a  Piper  Commanche  airplane  also  demonstrated  the 
effectiveness  of  Halon  1211  and  Halon  1301  in  extinguishing  hidden  electrical  and  hydraulic  fires 
behind  an  instrument  panel  (37).  In  summary,  the  safety  and  effectiveness  of  Halon  hand-held 
extinguishers  has  been  demonstrated  for  both  large  and  small  airplane  cabin  applications. 


FLOOR  FRCOOMm  LIGHTING 

Rapid  passenger  evacuation  is  the  most  critical  and  overriding  consideration  in  postcrash  cabin 
fire  safety.  Buoyant  hot  smoke  from  a  cabin  fire,  however,  clings  to  the  ceiling  and  rapidly 
obscures  conventional  ceiling  mounted  emergency  illumination  and  exit  signs,  thereby  reducing  the 
visibility  of  occupants  and  prolonging  evacuation  time.  The  resultant  reduction  in  visibility  and 
escape  guidance  often  occurs  when  the  lower  portion  of  the  cabin  is  relatively  free  of  combustion 
products.  FAA  tests  have  demonstrated  the  effectiveness  of  emergency  lighting  placed  below  the  smoke 
layer  in  the  proximity  of  the  cabin  floor.  3h  one  study,  the  improved  visibility  of  floor  proximity 
lighting  systems,  including  lights  mounted  on  armrests,  floor  mounted  electroluminescent  lights  and 
self-powered  betalights,  was  evidenced  during  full-scale  postcrash  cabin  fire  tests  (38).  Another 
study  translated  the  improved  visibility  of  low  level  lighting  to  faster  evacuation  rate  (39) . 

People  were  able  to  evacuate  in  approximately  20  percent  less  time  from  a  cabin  simulator  filled  with 
stratified  theatrical  smoke  when  seat  mounted  limiting  illuminated  the  main  aisle  than  from  the 
simulator  with  conventional  ceiling  limits.  In  a  third  study,  the  degree  of  merit  of  11  improved 
emergency  lighting  systems  was  evaluated  on  the  basis  of  illumination,  reliability,  cost,  and  other 
parameters  (40) . 

The  final  rule,  published  on  October  26,  1984,  required  floor  proximity  emergency  escape  path 
marking  to  enable  passengers  to  visually  identify  the  emergency  escape  path  along  the  cabin  aisle  and 
to  readily  identify  each  exit  by  reference  only  to  markings  and  visual  features  not  more  than  4  feet 
above  the  floor  (9).  All  in-service  airplanes,  type  certificated  after  1958,  were  required  to  comply 
with  the  new  design  standards  within  2  years,  or  by  November  26,  1986.  Issuance  of  the  rule  was 
followed  by  an  advisory  circular  (AC)  to  provide  guidance  material  for  use  for  demonstrating 
compliance  with  the  floor  proximity  lighting  rule  (41).  The  AC  clarified,  by  example,  systems  that 
could  or  would  not  meet  the  requirements  of  the  rule.  To  meet  the  requirements  of  25.812(e)(1)  for 
markings  that  enable  each  passenger  to  visually  identify  the  emergency  escape  path  along  the  cabin 
aisle  floor,  the  AC  states  that  the  system  must  provide  a  reasonable  degree  of  illumination  over  the 
entire  length  of  the  escape  path  along  the  aisle  floor.  A  distant  ligjht  at  an  exit  that  allows  the 
escape  path  to  remain  essentially  dark  would  not  be  acceptable.  Also,  the  requirement  to  readily 
identify  each  exit  by  reference  only  to  markings  and  visual  features  not  more  than  4  feet  above  the 
floor  would  not  be  met  by  a  system  that  provides  only  general  diffused  light  in  the  vicinity  of  the 
exit  or  a  system  which  merely  marks  the  fore  and  aft  location  of  the  exit  along  the  aisle  floor,  and 
not  the  exit  itself. 


CHHMEMEEE  PROTECTIVE  BREATHING  EQUUMENT 

Protection  of  crewmembers  against  smoke  and  toxic  gases  produced  by  an  in-flight  fire  includes 
fixed  protective  breathing  equipment  (FHE)  for  flight  deck  crewmembers  and  portable  FEE  for  cabin 
crewmembers.  Criteria  for  design  of  flight  crewmember  PEE  are  contained  in  TSO-C99  (42)  and  include 
requirements  for  testing  masks  and/or  goggles  for  smoke  leakage.  Portable  PEE  for  cabin  crewmembers 
is  required  for  all  transport  aircraft  by  July  6,  1989  (10).  Basically,  a  portable  PEE  must  be 
located  at  each  approved  hand-held  extinguisher  station. 


FINAL  COMMENTS 

In  recent  years  the  FAA  has  issued  an  unprecedented  series  of  new  standards  to  improve  fire 
safety  in  transport  aircraft.  Many  of  the  new  standards  are  products  of  FAA's  research,  engineering 
and  development  (R,  E  &  D)  program.  The  use  of  fire  blocking  layers  for  seat  cushions  and  low 
heat/smoke  release  interior  panels  are  expected  to  furnish  the  greatest  gains  in  airliner  fire  safety 
from  these  standards.  However,  it  is  unlikely  that  further  improvements  in  fire  safety  from  even 
more  fireworthy  interior  materials  can  be  anticipated  in  the  foreseeable  future  due  to  the  fact  that 
the  new,  stringent  FAA  fire  test  requirements,  especially  for  interior  panels,  are  driving  technology 
to  produce  suitable  composite  designs.  Exclusive  of  fuels  and  fuel  systems  safety  considerations, 
additional  improvements  in  aircraft  fire  safety  are  more  likely  from  current  R,  E  &  D  activities 
related  to  active  fire  protection,  such  as  cabin  water  mist  fire  suppression  or  enhanced  smoke 
venting. 
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FIGURE  1.  C-133  WIDE  BODY  CABIN  FIRE  TEST  ARTICLE 


FIGURE  2.  EFFECT  OF  SEAT  CUSHION  PROTECTION  ON  FRACTIONAL 

EFFECTIVE  DOSE 
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FIGURE  5.  POSTCRASH  FUEL  FIRE  OPEN  DOOR  SCENARIO 


OSU  HEAT  RELEASE 


FIGURE  6.  EFFECT  OF  COMPOSITE  PANEL  DESIGN  ON  FRACTIONAL 

EFFECTIVE  DOSE 
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FIGURE  7.  FAA  OSU  RATE  OF  HEAT  RELEASE  APPARATUS 
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FIGURE  8.  REPRODUCIBILITY  OF  HEAT  RELEASE  APPARATUS  -  FAA/AIA 
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FIGURE  9.  CARGO  LINER  RESISTANCE  TO  BURNTHROUGH 
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FIGURE  10.  FAA  CARGO  LINER  BURNTHROUGH  TEST  APPARATUS 
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FIGURE  11.  FAA  EVACUATION  SLIDE  RADIANT  HEAT  TEST  APPARATUS 
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FIGURE  12.  CABIN  GAS  PROFILES  DURING  HALON  1211  SEAT  FIRE 
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DISCUSSION 


C.  MOSES 

Could  you  clarify  which  of  the  new  fire-safety  technologies 
you  have  discussed  have  been  or  are  being  retrofitted  into 
aircraft  already  in  use,  and  which  will  only  appear  in  new 
aircraft? 

AUTHOR'S  REPLY: 

The  following  fire  safety  improvements  have  been  retrofitted 
into  the  U.S.  commercial  fleet:  seat  fire  blocking  layers,  floor 
proximity  lighting,  lavatory  detectors  and  extinguishers,  halon 
extinguishers  and  additional  hand-held  extinguishers.  Retrofit 
of  burnthrough  resistant  cargo  liners  is  required  in 
approximately  one  year.  The  new  regulation  for  low  heat/smoke 
release  panels  primarily  impacts  production  aircraft  and  has 
no  retrofit  provision;  however,  at  the  initial  major  refurbish¬ 
ment  of  the  cabin  interior  the  usage  of  low  heat/smoke  release 
materials  is  required. 

G.  COX 

You  are  using  the  OSU  apparatus  to  determine  rate  of  heat 
release.  Do  you  have  any  plans  to  move  to  the  cone  calorimeter? 

AUTHOR'S  REPLY: 

We  are  pleased  with  the  reproducibility  of  the  OSU 
apparatus.  Moreover,  there  are  different  difficulties  in 
measuring  heat  release  from  aircraft  materials  with  the  cone 
calorimeter  because  of  the  small  readings  of  oxygen  depletion. 

A.  URAL 

Have  you  consider  the  in-flight  fire  scenario  where  the 
ignition  has  taken  place  behind  the  wall  panels,  where  the 
fatalities  may  arise  due  to  smoke  generation. 

AUTHOR'S  REPLY: 

Yes,  We  are  nearing  completion  of  a  project  that  examines 
the  ignitability  and  fire  growth  in  hidden  or  inaccessible  cabin 
interiorlocations ,  such  as  behind  sidewall  panels,  in  lavatories, 
etc.  We  have  simulated  electrical  fault  ignition  sources, 
overheated  wiring  and  arcing,  in  these  hidden  areas  and  monitored 
the  cabin  conditions  in  a  full-scale  DC10  test  article.  Under 
these  ignition  conditions,  the  fire  will  self  extinguish  with 
barely  detectable  increased  temperature  or  toxic  gas  levels 
measured  in  the  cabin  .  During  some  tests  slight  smoke 
obscuration  is  measured. 

B.  TUCKER 

The  FAA  rule  requiring  floor  proximity  lighting  has  been 
in  effect  for  about  2\  years.  However,  it  appears  that  most 
airlines  do  not  include  this  feature  in  their  passenger  safety 
briefings.  Has  the  FAA  considered  making  mandatory  the  inclusion 
of  information  on  floor  proximity  lighting  in  passenger  briefings 
and/or  safety  information  brochures. 

AUTHOR'S  REPLY: 

MY  own  experience  is  that  more  airlines  are  now  announcing 
the  presence  of  floor  proximity  lighting  in  the  passenger  safety 
briefings.  A  new  Advisory  Circular  on  passenger  safety  briefings 
will  be  issued  shortly  by  FAA  with  a  recommendation  that 
information  on  floor  proximity  lighting  be  included  in  the 
passenger  briefing.  I  might  also  add  that  the  function  of  floor 
proximity  lighting  in  an  emergency  situation  would  be  rather 
obvious  to  the  passenger. 

F.  TAYLOR 

Have  you  conducted  any  tests  where  you  have  a  hole  in  the 
ceiling,  either  as  deliberate  venting  or  by  natural  burn  through? 

AUTHOR’S  REPLY: 

One  postcrash  fire  test  was  conducted  with  the  ceramic 
insulation  removed  in  the  area  of  the  fuselage  ceiling  near 
the  fuel  fire  ignition  source.  After  the  12  min.  test,  the 
fuselage  ceiling  was  not  penetrated.  Planned  FAA  tests  will 
more  thoroughly  examine  the  effect  of  a  fuselage  "roof"  opening. 
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Tension  Peeling  load 

PANEL  TESTING  COMPONENT  LEVEL  TESTING 


Typical  Test  Results 
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Aircraft  Hardening  Program  Aircraft  Test  Database 


B-707  Narrow-Body  Aircraft  Tests 
Comparison  of  Damage  Modes 


(Single  Suitcase) 


Pressurized  vs.  Non-Pressurized  C-880  Test 


LD-3  Threat  Characterization  Test  Series 


Integrated  Structural  Response  Methodologies 


Next  step  -  Add  fragmentation  effects 
from  LD-3  and  luggage 


Wide-Body  Aircraft  Blast  Test 
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To  determine  the  minimum  charge  size  and  charge  location  to 
cause  catastrophic  damage,  to  a  wide-body  aircraft,  from  a 
bomb  placed  in  a  LD-3  luggage  container.  cajbb&a/c- 
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Repeat  ST  1  without  liner 
using  final  ST  1  charge  size 
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Reusable  Blast  Test  Fixture 
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Reusable  Blast  Test  Fixture 


RBTF  Basic  Design  Concent 1 


RBTF  Basic  Design  Concept 2 


Adding  this  steel  design  to  an  existing  20’-D  shock-tube  creates  a  low- 
cost  RBTF.  -  The  opening  will  be  fitted  with  flight-weight  test  sections. 
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I.  INTRODUCTION 


A.  AVIONICS 

Electronic  devices  and  systems  that  are  used  in  aircraft 
are  commonly  referred  to  as  avionics.  Typical  systems  within 
the  general  class  of  avionics  systems  include  [Ref.  1:  p.  1]: 

•  Flight  control  systems  (e.g.  fly-by -wire  controls, 
autopilot) . 

•  Engine  control  systems  (e.g.  Full  Authority  Digital 
Electronic  Controls  (FADEC) ) . 

•  Flight  avionics  systems  (e.g.  communications, 
navigation,  flight  instruments) . 

•  Tactical  sensor  systems,  both  passive  and  active  (e.g. 
radar,  electro-optical  and  electronic  warfare) . 

•  Computer  systems. 

Avionics  systems  are  generally  divided  between  analog  and 
digital  types,  depending  on  the  manner  in  which  the  electronic 
signal  is  represented.  Older  analog  avionics  systems  have 
largely  been  replaced  by  the  digital  avionics  systems  that  are 
used  in  most  modern  tactical  aircraft.  These  digital  avionics 
systems  are  characterized  by: 

•  Widespread  use  of  microprocessors  for  computation 

•  Electronic  sensors  using  digital  signal  processing 

•  Programmable  displays  such  as  cathode  ray  tubes  or 
liquid  crystal  displays 

•  Extensive  use  of  high  speed  digital  data  buses. 

There  are  many  design  and  performance  advantages  of 
digital  avionics  architectures,  including:  reduced  weight. 
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improved  reliability,  increased  performance,  reduced  component 
count,  sensor  data  sharing/ sensor  fusion,  etc.  However,  the 
cost  of  the  digital  avionics  can  be  high;  in  modern  tactical 
aircraft  the  avionics  cost  is  approximately  30-50%  of  the 
total  aircraft  fly-away  cost  [Ref.  2].  Because  of  the  high 
cost  of  modern  tactical  aircraft,  as  well  as  for  many  other 
good  reasons,  tactical  aircraft  must  be  survivable  if  they  are 
to  be  effective. 


B.  .  SURVIVABILITY 


A  tactical  aircraft  must  be  designed  with  the  hostile 
environment  of  combat  in  mind  so  that  the  aircraft  can  survive 
to  complete  its  mission  and  return  to  base.  More  efficient 
and  capable  tactical  aircraft  should  also  be  more  survivable 
in  a  hostile  environment.  Survivability  in  combat  is  defined 
as  "the  capability  of  an  aircraft  to  avoid  and/or  withstand  a 
man-made  hostile  environment"  [Ref.  3:  p.  1].  A  tactical 
aircraft  should  be  designed  to  avoid  being  hit,  and  to  survive 
if  hit.  Survivability  is  made  up  of  two  elements: 
susceptibility,  the  inability  of  the  aircraft  to  avoid  being 
damaged  by  the  various  elements  of  the  man-made  hostile 
environment  [Ref.  3:  p.223];  and  vulnerability,  the  inability 
of  the  aircraft  to  withstand  th^  damage  caused  by  the  man-made 
hostile  environment  [Ref.  3:  p.  135]. 

The  susceptibility  of  an  aircraft  is  influenced  by  the 
aircraft's  design,  the  tactics  that  are  used  and  the 
survivability  equipment  and  weapons  that  it  carries.  Aircraft 
designed  for  combat  environments  generally  incorporate 
features  designed  to  reduce  the  likelihood  of  detection  by 
hostile  forces  and  features  designed  to  reduce  the  probability 
of  being  hit,  if  detected.  One  such  susceptibility  reduction 
feature  is  "stealth",  which  includes  signature  reduction 
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techniques  applicable  to  the  aircraft's  radar,  infrared, 
visual  and  acoustic  signatures.  The  use  of  appropriate 
tactics  is  also  important  to  mission  success. 

The  survivability  goal  is  to  remain  undetected,  or  if 
detected  to  be  difficult  to  hit.  Once  hit,  the  goal  shifts  to 
being  able  to  withstand  the  hit(s)  and  still  survive.  The 
vulnerability  of  an  aircraft  is  influenced  by  the  aircraft's 
design  and  the  choice  of  survivability  features  that  reduce 
the  amount  and/or  severity  of  damage  when  the  aircraft  is  hit. 
Typical  threat  damage  mechanisms  include  penetrators  and 
fragments  from  missile  and  gun  high  explosive  warheads,  blast 
and  the  most  recent  threat  from  various  high  power  radiation 
sources  (e.g.  electromagnetic  pulse,  particle  beam  and  laser). 

Aircraft  designers  do  not  generally  choose  a  digital 
avionics  system  architecture  because  of  its  effect  on  the 
survivability  of  the  aircraft,  but  rather  for  its  performance 
advantages.  Combat  experience  gained  in  the  1950s,  1960s  and 
1970s  in  Korea,  Southeast  Asia  and  the  Middle  East  shows  that 
aircraft  were  lost  primarily  due  to  damage  to  the  fuel  system, 
engines,  flight  controls,  hydraulic  systems  and  crew  [Ref.  3: 
p  134].  The  aircraft  then  in  use  did  not  incorporate 
extensive  digital  avionics  systems.  Modern  tactical  aircraft 
which  incorporate  extensive  digital  avionics  systems  were 
introduced  in  the  mid-1970s  and  have  seen  only  limited  combat 
use.  As  a  result,  we  have  limited  data  on  the  causal  factors 
leading  to  the  -oss  of  modern  tactical  aircraft  and 
specifically  to  the  contributions  of  digital  avionics  systems 
to  aircraft  combat  survivability. 

One  characteristic  of  a  modern  digital  avionics  system  is 
its  high  level  of  signal  integration,  as  compared  to  older 
avionics  systems.  This  integration  is  a  key  element  in 
improving  the  efficiency  and  capability  of  the  aircraft  and  is 
one  of  the  reasons  for  its  improved  performance.  However,  the 
fact  that  the  majority  of  the  avionics  devices  are  dependent 
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upon  information  shared  over  the  data  buses  is  a  disadvantage 
when  the  data  bus  information  flow  is  interrupted  or 
corrupted.  For  example,  in  the  case  of  fly-by-wire  flight 
control  systems  on  unstable  aircraft,  where  the  control  of  the 
aircraft  is  dependent  upon  maintaining  a  continuous  path 
between  the  flight  control  computer  and  the  control  surface 
servo  actuators,  combat  damage  that  interrupts  or  corrupts 
this  information  flow  could  result  in  the  loss  of , aircraft 
control.  Thus,  the  choice  of  a  digital  avionics  architecture 
can  have  an  impact  on  the  overall  combat  survivability  of  the 
aircraft. 

C.  SURVIVABILITY  ASSESSMENT 

Traditional  methods  of  assessing  the  effects  of  component 
failure  or  damage  to  an  aircraft  fall  within  the  discipline  of 
system  safety  engineering.  System  safety  engineering  conducts 
hazard  analyses  (also  called  system  safety  analyses)  of  an 
aircraft  in  order  to  identify  actual  and  potential  hazards. 
Hazards  are  then  assessed  by  considering  the  hazard  severity 
and  potential  frequency  of  occurrence.  Once  identified  and 
assessed,  methods  of  resolving  the  hazards  are  proposed. 

System  safety  engineers  use  critical  component  analysis  tools 
sue ~  as  the  Fault  Tree  Analysis  (FTA)  and  the  Failure  Modes 
and  Effects  Analysis  (FMEA) . 

A  Fault  Tree  Analysis  (FTA)  is  a  top-down  approach  which 
begins  with  a  given  undesired  event,  such  as  loss  of  control, 
and  then  traces  the  possible  causes  of  that  event  [Ref.  4:  p. 
17].  A  Failure  Modes  and  Effects  Analysis  (FMEA)  is  a  bottom- 
up  approach  that  identifies  and  records  all  possible  failure 
modes  of  a  component  or  subsystem  and  determines  the  effects 
of  these  failure  modes.  The  effects  are  then  linked  to  the 
ability  of  the  component  or  subsystem  to  perform  essential 
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functions  [Ref.  4:  p.  11].  The  FMEA  does  not  specify  the 
cause  of  the  component  failure.  When  failures  caused  by 
combat  damage  are  investigated,  the  process  is  called  a  Damage 
Mode  and  Effects  Analysis  (DMEA)  [Ref.  3:  p.  142].  While  it 
is  not  necessary  to  do  both,  combining  the  top-down  approach 
of  Fault  Tree  Analysis  (FTA)  with  the  bottom-up  approach  of 
the  Failure  Modes  and  Effects  Analysis  (FMEA)  can  give  a 
representative  picture  of  the  impact  of  various  component 
failures.  After  an  FTA  and/or  FMEA  has  been  conducted,  a 
Vulnerability  Assessment  (VA)  of  the  aircraft  can  be  made. 

A  Vulnerability  Assessment  is  the  process  of  assigning 
numerical  values  for  the  various  measures  of  vulnerability. 
Vulnerable  area,  defined  as  that  area  on  the  aircraft  which  if 
hit  would  cause  a  kill  of  the  aircraft,  is  one  such  measure 
[Ref  3:  p. 153 ] .  Numerical  assessment  can  be  done  through  the 
use  of  computer  programs,  such  as  the  Computation  of 
Vulnerable  Area  and  Repair  Time  (COVART)  program  [Ref.  5]. 
COVART  is  a  product  of  the  Joint  Technical  Coordinating  Group 
for  Munitions  Effectiveness,  Aerial  Target  Vulnerability 
Working  Group,  and  is  used  to  determine  the  vulnerable  area  of 
aircraft  damaged  by  the  impact  of  single  kinetic-energy 
penetrators . 

D.  THESIS  ORGANIZATION 

The  contributions  of  modern  digital  avionics  systems  to 
the  survivability  of  tactical  aircraft  are  examined  in  this 
thesis.  Each  of  the  following  systems  within  the  general 
class  of  avionics  is  discussed: 

•  Flight  control  systems 

•  Engine  control  systems 

•  Flight  avionics  systems 
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•  Tactical  sensor  systems 

•  Computer  systems 

Chapter  II  provides  background  information  on  digital  avionics 
systems  and  architectures,  summarizing  their  key  features  and 
characteristics.  The  focus  of  Chapters  III  and  IV  is  on  the 
contributions  of  the  avionics  systems  and  architectures  to 
aircraft  susceptibility  and  vulnerability,  respectively. 
Chapter  V  discusses  a  proposed  methodology  by  which  the 
contributions  of  an  avionics  system  to  the  vulnerable  area  of 
a  tactical  aircraft  can  be  computed.  Chapter  VI  contains 
design  guidance  and  recommendations  to  reduce  the 
vulnerability  of  digital  avionics  systems  in  order  tc  increase 
a  tactical  aircraft's  combat  survivability. 
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II.  DIGITAL  AVIONICS  SYSTEMS  BACKGROUND 


A.  DIGITAL  AVIONICS 


The  commonly  applied  definition  of  avionics  includes  all 
analog  and  digital  electronic  devices  that  are  used  in 
aircraft.  Older  analog  systems  that  use  variable  resistance, 
capacitance  and  inductance  and  have  an  analog  output  signal 
are  no  longer  the  basis  for  new  designs.  Most  modern  aircraft 
use  a  digital  avionics  system  that  is  made  up  of  sensors, 
displays,  data  buses  and  microprocessors  that  are  combi;. 3d  to 
perform  various  operations  on  binary  electronic  signals. 

The  binary  signals  are  typically  shown  as  yes  equals  one, 
or  positive  voltage,  and  no  equals  zero,  or  negative  voltage, 
although  the  reverse  is.  also  possible.  The  output  of  the 
system  operations  is  a  string  of  ones  and  zeroes,  encoded  in 
accordance  with  a  specific  signal  protocol  that  travels 
throughout  the  aircraft  on  digital  data  buses. 

In  a  digital  avionics  architecture,  the  tasks  are 
functionally  allocated  between  the  software,  hardware  and  crew 
[Ref.  6:  p.  8].  The  level  of  integration  is  dependent  upon 
the  choice  of  avionics  architecture,  the  size  of  the  crew  and 
the  number  of  avionics  systems  to  be  integrated.  The  design 
choice  of  a  digital  avionics  system  is  primarily  important 
because  of  the  additional  capabilities,  such  as  weapons, 
sensors  or  displays,  that  can  be  utilized  by  the  aircraft  and 
crew.  Digital  avionics  systems  can  contribute  [Ref.  6]: 

•  advanced  sensors,  processors  and  displays 

•  expert  systems 

•  sensor  fusion/weaponization 


•  improved  command,  control,  communications  and 
navigation 

to  the  overall  capabilities  of  the  tactical  aircraft. 

B.  DIGITAL  AVIONICS  ARCHITECTURES 

Three  main  types  of  digital  avionics  architectures  are 
available  to  the  designer;  federated,  centralized  (or 
integrated)  and  distributed  [Ref.  6:  p.  119].  Each  type  has 
specific  characteristics,  advantages  and  disadvantages,  with 
the  optimum  cho-ce  dependent  upon  aircraft  and  mission 
requirements. 

The  majority  of  current  generation  aircraft  (e.g.  F-16, 
F/A-18)  incorporate  a  federated  architecture.  Many  earlier 
generation  aircraft  (e.g.  F-14,  A-10)  are  being  retrofitted 
with  a  hybrid  federated  architecture.  Future  generation 
aircraft  (e.g.  F-22,  JAST  derivatives)  will  probably 
incorporate  either  a  centralized  architecture  or  a  distributed 
architecture. 

The  federated  architecture  is  shown  in  Figure  1.  "A 
federated  architecture  is  characterized  by  each  major  system, 

. . . ,  sharing  input  and  sensor  data  from  a  common  set  of 
hardware,  and  consequently  sharing  their  computed  results  over 
data  buses  [Ref.  6:  p.  119]."  This  design  allows  for 
relatively  independent  systems  which  combine  in  using  a  common 
data  base.  As  a  result,  there  is  a  degree  of 
compartmentalization  inherent  in  this  architecture.  A 
federated  system  in  a  military  aircraft  typically  shares  data 
over  the  MIL-STD-1553B  data  bus. 

Some  future  generation  aircraft  will  probably  incorporate 
the  centralized  architecture  shown  in  Figure  2.  "A 
centralized  architecture  is  characterized  by  signal 
conditioning  and  computations  taking  place  in  one  or  more 
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Figure  2.  Centralized  (Integrated)  Architecture,  from  Ref  [1] 
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computers. .. located  in  the  avionics  bay  with  sensor  and 
command  signals  transmitted  over  data  buses  [Ref.  6:  p.120]." 
This  type  may  also  be  called  an  integrated  architecture  [Ref. 
1:  p.  6].  A  centralized  system  in  a  military  aircraft  may  use 
several  different  kinds  of  data  buses,  depending  on  the 
performance  requirements. 

The  distributed  architecture  that  is  being  evaluated  for 
use  in  future  tactical  aircraft  combines  many  of  the  features 
of  both  the  federated  and  centralized  architectures,  as  shown 
in  Figure  3.  "A  distributed  architecture  has  multiple 
processors  throughout  the  aircraft  that  are  assigned  computing 
and  control  tasks  in  real  time  by  executive  software  as  a 
function  of  mission  phase  and/or  system  status  [Ref.  6: 
p.120]  "  These  distributed  processors  may  perform  significant 
amounts  of  signal  processing  at  or  near  the  sensors  or 
actuators.  A  distributed  system  in  a  military  aircraft  is 
likely  to  use  several  high  performance  digital  data  buses, 
possibly  based  on  civil  computer  networking  standards. 


»-  SYSTEM  INTERCONNECT 

Figure  3.  Distributed  Architecture,  from  Ref.[l] 


C.  AIRCRAFT  ELECTRICAL  POWER 


In  all  digital  avionics  system  architectures,  there  is  an 
assumption  of  reliable,  uninterrupted  electrical  power.  With 
analog  avionics  systems,  it  was  relatively  easy  to  design 
systems  that  were  insensitive  to  interruptions  in  aircraft 
power  and  tolerant  of  voltage  or  frequency  variations.  The 
aircraft  power  system  for  modern  digital  avionics  systems  is 
not  so  easy  to  design.  Most  digital  systems,  especially 
microprocessors,  are  highly  intolerant  of  interruptions  in 
power  and  many  are  sensitive  to  variations  in  supply  voltage 
and  frequency.  The  requirements  of  MIL-STD-704:  Aircraft 
Electrical  Power  Characteristics  [Ref.  7]  for  military 
aircraft,  or  RTCA  document  DO-160:  Environmental  Conditions 
[Ref.  8]  for  commercial  aircraft,  detail  the  aircraft 
electrical  power  environment. 

These  two  standards  describe  the  over  and  under-voltage 
conditions,  frequency  variations,  power  interruptions  and 
other  conditions  that  the  designer  must  accommodate.  Of 
particular  interest  to  the  designer  is  the  assumption  that 
military  aircraft  electrical  power  systems  may  exhibit  power 
interruptions  of  up  to  50ms  under  transfer  conditions  [Ref.  6: 
p.  79],  while  power  interrupts  of  up  to  is  can  be  expected  in 
civil  aircraft  [Ref  6:  p.  81].  This  is  a  significant  design 
driver,  especially  for  volatile  microprocessor  memory.  The 
use  of  static  random  access  memory  (SRAM) ,  which  retains  its 
contents  only  so  long  as  power  is  applied,  usually  causes  a 
designer  to  specify  an  alternate  or  back-up  to  the  aircraft 
power  supply.  Some  types  of  dynamic  random  access  memory 
(DRAM) ,  which  use  capacitance  to  retain  memory  contents  and 
which  depend  on  periodic  refresh  cycles,  may  also  cause  the 
designer  to  consider  an  alternate  or  back-up  power  supply. 

The  criticality  of  the  avionics  function  determines  whether  a 
given  device  requires  uninterrupted  power  or  not. 
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The  aircraft  electrical  loads  are  characterized  as  either 
critical,  essential  or  utility  [Ref.  6:  p.  88].  Critical 
loads  include  flight  control  systems,  cockpit  flight 
instruments  and  cockpit  displays.  The  nature  of  these  systems 
demands  that  multiple,  redundant  power  buses  be  provided  and 
that  provisions  for  uninterruptable  power  be  made  available. 
Avionics  systems  of  lesser  criticality  are  typically  referred 
to  as  essential  loads,  examples  of  which  are  the  tactical 
sensors.  Systems  that  are  not  essential  to  safe  flight,  such 
as  galley  equipment  or  entertainment  systems,  are  usually 
referred  to  as  utility  loads.  Redundant  power  generation  and 
storage  systems  for  the  critical  and  essential  loads  are 
typically  specified  in  order  to  obtain  the  required 
reliability  of  the  avionics  system  and  to  provide  backups  in 
case  of  malfunction  or  damage. 

D.  AVIONICS  DATA  BUSES 

1.  Military  Aircraft 

The  digital  avionics  data  buses  may  be  thought  of  as  the 
nervous  system  of  the  aircraft,  with  multiplexed  signals  being 
shared  between  systems  connected  by  the  data  bus.  Current 
military  aircraft  typically  incorporate  the  MIL-STD-1553B  data 
bus,  with  some  aircraft  incorporating  the  fiber-optic  cable 
version  of  the  1553B  protocol,  the  MIL-STD-1773  data  bus. 

Future  tactical  aircraft  are  likely  to  incorporate  the  High 
Speed  Data  Bus  (HSDB) ,  probably  in  combination  with  the  1553B 
and  1773  data  buses.  It  is  also  likely  that  avionics 
equipment  incorporating  either  of  the  commercial  data  bus 
standards,  ARINC  429  or  ARINC  629,  will  be  used  on  military 
aircraft. 
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The  MIL-STD-1553B  data  bus  is  characterized  by  the  use  of 
time-division  multiplexing  and  a  bus  controller.  The  bus 
controller  functions  as  a  "traffic  cop"  to  prevent  two  or  more 
devices  from  transmitting  simultaneously.  If  the  bus 
controller  fails,  the  data  bus  is  rendered  inoperative.  The 
data  bus  protocol  and  the  message  formats  are  called  out  in 
the  specification  document  [Ref.  9]. 

The  1553B  operates  at  the  relatively  slow  data  transfer 
rate  of  1  MBit/s.  In  order  to  increase  reliability  and  reduce 
electromagnetic  interference,  the  1553B  data  bus  uses  a 
twisted,  shielded  pair  of  wire  cables  which  is  routed  through 
the  aircraft  Typical  cable  design  is  shown  in  Figure  4. 
Depending  on  the  criticality  of  the  function,  some  aircraft 
use  as  many  as  four  1553B  data  buses  in  parallel. 


Figure  4,  MIL-STD-1553B  Cable,  after  Ref  [9] 

The  DOD-STD-1773  digital  data  bus  [Ref.  10]  is  a  fiber¬ 
optic  cable  implementation  of  the  same  data  bus  protocol  used 
in  the  1553B.  The  intent  of  the  change  to  fiber-optic  cables 
was  to  reduce  the  possibility  of  electromagnetic  interference 
and  to  reduce  weight.  The  current  implementation  is 
restricted  to  1  MBit/s,  although  the  possibility  exists  to 
increase  the  data  transfer  rate  of  the  1773  data  bus  to  8 
MBit/s  in  the  enhanced  mode.  The  1773  data  bus  incorporates 
most  of  the  features  of  the  1553B,  including  a  bus  controller, 
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with  the  twisted,  shielded  cable  replaced  by  a  fiber-optic 
cable,  such  as  Figure  5. 
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Figure  5,  DOD-STD-1773  Fiber-Optic  Cable,  after  Ref  [10] 

The  latest  military  standard  digital  data  bus  is  the  High 
Speed  Data  Bus  (HSDB) ,  which  was  developed  by  the  Air  Force  to 
provide  a  much  increased  rate  of  data  transmission  [Ref.  11]. 
The  HSDB  can  transmit  data  at  up  to  50  MBit/s  and  can  use 
several  different  bus  topologies  in  either  the  conventional 
twisted,  shielded  pair  or  fiber-optic  cable  implementations. 

A  key  design  feature  of  the  HSDB  is  a  "token  passing"  control 
architecture,  which  removes  tne  requirement  for  a  bus 
controller.  This  is  a  key  design  advantage  of  the  HSDB  over 
the  earlier  MIL-STD  1553B  or  DOD-STD-1773  data  bus  designs 
because  a  single  point  of  failure  (kill)  has  been  avoided. 

2.  Civil  Aircraft 

The  civil  standards  for  digital  data  buses  in  transport 
aircraft  are  the  ARINC  429  [Ref.  12]  and  ARINC  629  [Ref  13]. 
The  ARINC  429  digital  data  bus  is  a  simplex  bus  in  which  there 
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is  only  one  transmitter  but  multiple  receivers.  This  design 
choice  avoids  the  use  of  a  bus  controller,  although  it  does 
require  the  use  of  multiple  data  buses.  There  is  a 
requirement  for  a  dedicated  ARINC  429  data  bus  for  each  pair 
of  avionics  devices  that  must  transfer  information  to  one 
another.  The  ARINC  429  uses  a  twisted,  shielded  pair  wire 
cable  very  similar  to  that  used  by  the  MIL-STD-1553B.  The 
rate  of  data  transmission  is  slower  than  the  1553B,  at  either 
12  to  14.5  KBit/s  (low  speed)  or  100  KBit/s  (high  speed). 
Because  the  ARINC  429  is  a  simplex  bus  with  a  single 
transmitter,  there  are  multiple  ARINC  429  data  buses.  This 
increases  reliability  and  eases  certification  at  the  cost  of 
additional  weight  and  complexity. 

The  latest  civil  digital  data  bus  standard  is  the  ARINC 
629.  This  is  a  multi-transmitter  data  bus  that  also  does  not 
require  a  data  bus  controller.  In  the  ARINC  629  design,  each 
avionics  device  is  granted  autonomous  access  to  the  bus  based 
on  a  complex  timing  scheme.  The  rate  of  data  transmission,  at 
2  MBit/s,  is  faster  than  the  1553B  and  the  ARINC  629  can  use 
any  one  of  three  cable  designs:  wire,  with  either  inductive  or 
voltage  coupling  and  optical  fiber.  The  use  of  inductive 
coupling  avoids  the  weight  penalty  associated  with  cable 
shielding,  since  the  data  bus  signals  are  current-coupled 
instead  of  voltage-coupled.  This  data  bus  has  been  chosen  for 
use  in  the  Boeing  777. 


E.  MICROPROCESSORS 


Recent  advances  in  microelectronic  technology  have  made 
it  possible  to  use  computers  as  an  integral  part  of  avionics 
systems.  Miniaturized  digital  computers  are  typically 
referred  to  as  microprocessors,  or  even  as  "chips”,  because 
they  are  usually  contained  on  a  single  integrated  circuit 
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(I.C.)  chip.  They  are  used  for  many  different  functions  (e.g. 
numeric  calculations,  control,  graphics  displays  and  signal 
processing) .  Because  of  their  small  size  and  robust 
capability,  these  devices  are  found  in  nearly  all  avionics 
systems . 

Microprocessors,  as  a  group,  are  generally  understood  to 
include  both  general  purpose  computers  and  digital  signal 
processors.  Within  general  purpose  computers,  microprocessors 
are  divided  into  Complex  Instruction  Set  Computer  (CISC)  and 
Reduced  Instruction  Set  Computer  (RISC)  types.  [Ref.  1:  p.  70] 

The  most  common  type  of  microprocessor  is  the  CISC  chip, 
characterized  by  th-  various  MIL-STD-1750A  16-bit  computer 
chips  and  the  Intel  80X86  series  chips  that  are  popular  in 
personal  computers.  These  are  general  purpose  microprocessors 
which  incorporate  the  hardware  and  software  needed  to  carry 
out  many  different  complex  operations.  Their  internal 
operations  may  take  one,  two  or  even  several  cycles  to 
complete.  CISC  computers  are  very  flexible  and  powerful  and 
serve  as  the  "brains"  of  many  avionics  systems. 

An  emerging  microprocessor  type  is  the  RISC  chip, 
characterized  by  the  Sun  SPARC  and  the  Motorola  Power  PC 
chips.  These  are  general  purpose  microprocessors  whose  design 
has  been  optimized  to  support  completion  of  internal  tasks 
within  a  single  cycle.  RISC  computers  are  more  efficient  than 
the  CISC  design,  although  they  require  software  that  is 
optimized  for  the  smaller  number  of  instructions.  RISC  chips 
have  found  significant  use  as  the  "engines"  for  work  stations 
and  are  finding  uses  aboard  aircraft  avionics  systems. 

The  third  type  of  microprocessor  is  the  Digital  Signal 
Processing  (DSP)  chip.  The  DSP  chip  is  usually  dedicated  to 
signal  processing. applications  where  extremely  efficient 
input/ output  capability  is  important  due  to  the  sheer  volume 
of  data  to  be  processed.  DSP  chips  are  commonly  found  in 
avionics  sensor  systems  (e.g.  radars,  acoustic  processors). 
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F.  SENSORS 


There  are  many  avionics  devices  that  detect  and  respond 
to  electromagnetic,  e.g.  infrared  or  visual  wavelength, 
signals.  These  include  both  active  devices,  which  can 
transmit  signals,  and  passive  devices,  which  only  receive 
signals.  Examples  of  active  devices  include  radar  sets  and 
radio  communication  systems.  Examples  of  passive  devices 
include  infrared  detection  systems  and  radio  navigation 
receivers. 

G.  AVIONICS  DISPLAYS 

The  cockpits  of  today's  modern  tactical  aircraft  and 
civil  air  transport  aircraft  are  now  host  to  numerous 
programmable  displays  and  crew  interface  devices.  The 
familiar  analog,  electro-mechanical  gauges  that  were  the 
standard  for  the  1950s  through  early  1970s  aircraft  cockpits 
have  largely  been  replaced  by  systems  incorporating  either 
cathode  ray  tube  (CRT)  or  liquid  crystal  display  (LCD) 
technology.  These  video  display  devices  provide  the  same  sort 
of  information  to  the  pilot;  heading,  altitude,  direction, 
speed,  navigation  cues,  etc.  The  format  of  the  display  is  in 
many  cases  similar  or  even  identical  to  the  electro-mechanical 
device  that  the  CRT  or  LCD  replaces.  However,  the  video 
displays  are  not  limited  to  emulating  the  older  analog 
devices.  They  can  be  programmed  to  combine  the  information 
that  formerly  required  two  or  more  instruments  to  display  into 
a  single  "picture”  for  the  pilot.  For  the  crew  interface 
devices  (e.g.  multifunction  display  control  panels)  the  new 
touchpads,  keys  and  digital  readouts  have  replaced  the 
familiar  knobs  and  dials  of  earlier  aircraft  cockpits. 
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These  new  digital  displays  and  crew  interface  devices  are 
based  on  the  use  of  microprocessors  for  control  of  the  video 
display.  The  cockpit  instruments,  especially  the  flight 
instruments,  are  generally  considered  to  be  critical  systems. 
As  a  result,  the  certification  of  software  as  well  as  hardware 
has  emerged  as  a  significant  design  driver  in  digital  avionics 
systems . 

The  flight  critical  CRT  or  LCD  displays  must:  be  assured 
of  reliable,  uninterrupted  power;  have  software  that  is 
demonstrated  to  be  reliable  in  use;  and  have  hardware  that 
meets  or  exceeds  the  reliability  standards  for  the 
application.  Thus,  ■‘'he  possibility  of  damage  to  the  display 
itself,  the  interconnecting  wiring  or  data  bus,  the  power 
supply  and  the  source  of  information  to  be  displayed  must  be 
considered  when  examining  safety  and  survivability.  The 
possibility  of  damage  to  the  software,  or  of  a  hidden  "bug*1  in 
the  software,  is  also  a  concern.  Damage  to  any  one  of  these 
elements  could  cause  failure  of  the  cockpit  display  systems 
and  contribute  to  loss  of  control  of  the  aircraft. 
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III.  SUSCEPTIBILITY  EFFECTS 


A.  SUSCEPTIBILITY 


Aircraft  combat  survivability  is  made  up  of  two  elements: 
susceptibility,  the  inability  of  the  aircraft  to  avoid  being 
damaged  by  the  various  elements  of  the  man-made  hostile 
environment;  and  vulnerability,  the  inability  of  the  aircraft 
to  withstand  the  damage  caused  by  the  man-made  hostile 
environment  [Ref.  3] .  Since  the  susceptibility  of  an  aircraft 
is  influence!  by  the  aircraft's  design,  tactics,  equipment  and 
weapons,  the  contributions  of  a  digital  avionics  system  should 
be  measured  by  both  direct  and  indirect  contributions  to 
susceptibility  reduction.  This  chapter  will  explore  those 
contributions  of  the  digital  data  buses  used  in  digital 
avionics  systems  to  the  susceptibility  of  an  aircraft. 

The  choice  of  a  digital  avionics  system  will  have  an 
effect  on  the  six  major  concepts  for  reducing  susceptibility 
[Ref.  3]: 

•  Threat  warning . 

•  Noise  jamming  and  deceiving. 

•  Signature  reduction. 

•  Expendables . 

•  Threat  suppression. 

•  Tactics. 
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B.  THREAT  WARNING 


The  first  of  these  susceptibility  reduction  concepts, 
threat  warning,  refers  to  aircraft  systems  that  provide 
information  on  the  location,  type  and  status  of  the  threat 
elements  in  the  vicinity  of  the  aircraft.  Examples  of  threat 
warning  systems  include:  radar  warning  receivers,  laser 
warning  receivers  and  missile  approach  warning  systems. 

These  systems  can  be  installed  in  an  aircraft  in  a  "stand 
alone"  mode,  with  discrete  wiring,  controls  and  display(s)  for 
each  individual  system.  If  a  digital  data  bus  design  is  used 
instead,  the  connectivity  options  that  are  available  make  it 
possible  to  replace  many  of  the  discrete  portions  of  the 
system.  For  example,  the  data  bi  s  can  be  used  to  interconnect 
the  antenna (s),  processor,  controls  and  displays  of  a  threat 
warning  system.  A  higher  level  of  integration  is  also 
possible,  where  the  control  and  display  functions  are  shared 
with  other  systems.  If  the  display  processor  is  sufficiently 
capable,  sensor  fusion  techniques,  such  as  correlating  radar 
returns  with  threat  warning  data,  are  possible.  Another 
indirect  benefit  of  the  use  of  a  data  bus  can  be  to  allow  for 
queuing  of  an  expendables  launcher,  based  on  the  threat 
warning  system.  Therefore,  the  contributions  of  a  digital 
data  bus  to  the  susceptibility  reduction  factor  of  threat 
warning  are  due  ^ ~  the  connectivity,  shared  control  and  shared 
displays,  along  with  options  for  sensor  fusion  and  queuing  of 
expendables. 

C.  NOISE  JAMMING  AND  DECEIVING 


The  second  susceptibility  reduction  concept  is  noise 
jamming  and  deceiving,  also  called  "jamming",  "spoofing"  or 
"defensive  electronic  countermeasures  (DECM) " .  There  are  many 
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different  techniques  available,  each  of  which  exploits  some 
weakness  in  the  threat  system. 

As  with  threat  warning,  these  active  noise  jamming  and 
deceiving  systems  can  be  installed  in  an  aircraft  in  a  "stand 
alone"  mode,  with  discrete  wiring,  controls  and  display (s)  for 
each  individual  system.  If  a  digital  data  bus  design  is  used 
instead,  the  connectivity  options  that  are  available  make  it 
possible  to  replace  many  of  the  discrete  portions  of  the 
system.  Queuing  of  an  expendables  launcher  in  concert  with 
the  noise  jamming  and  deceiving  system  is  also  possible. 
Therefore,  the  contributions  of  a  digital  data  bus  to  the 
susceptibility  reduction  factor  of  noise  jamming  and  deceiving 
are  due  to  the  connectivity,  shared  control  and  shared 
displays,  along  with  the  option  for  queuing  of  expendables. 

D.  SIGNATURE  REDUCTION 

The  third  susceptibility  reduction  concept  is  signature 
reduction,  sometimes  referred  to  as  "stealth".  Signature 
reduction  typically  encompasses  the  radar,  infrared,  noise  and 
visual  signatures.  The  digital  data  bus  itself  gives  off 
virtually  no  electromagnetic  or  noise  signature  that  is 
detectable  outside  the  aircraft  since  it  operates  at  very  low 
voltages  within  either  a  shielded  cable  or  a  fiber  optic 
cable. 

However,  a  major  consideration  of  radar  signature 
reduction  is  to  reduce  the  number  and  size  of  radar 
reflectors,  of  which  antennas  are  a  prime  example.  The  use  of 
a  digital  data  bus,  with  its  options  for  connectivity,  can 
make  possible  the  sharing  of  sensor  apertures,  thus  reducing 
the  number  and/or  size  of  the  antennas  and  hence  the  radar 
signature. 
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E.  EXPENDABLES 


The  fourth  susceptibility  reduction  concept  is  the  use  of 
expendables,  usually  understood  to  include  chaff,  flares, 
active  jammers  and  aerosols.  Expendables  are  usually  designed 
to  counter  radar,  infrared  and  visually  directed  weapons. 

As  with  threat  warning,  these  expendables  systems  can  be 
installed  in  an  aircraft  in  a  “stand  alone"  mode,  with 
discrete  wiring,  controls  and  display (s)  for  each  individual 
system.  If  a  digital  data  bus  design  is  used  instead,  the 
connectivity  options  that  are  available  make  it  possible  to 
replace  many  of  the  discrete  portions  of  the  system  Queuing 
of  an  expendables  launcher  in  concert  with  the  noise  jamming 
and  deceiving  system  or  in  concert  with  the  threat  warning 
system  is  also  possible. 

F.  THREAT  SUPPRESSION 

The  fifth  susceptibility  reduction  concept  is  threat 
suppression,  generally  understood  as  a  means  of  either  keeping 
the  bad  guys  from  shooting  at  you  or  destroying  their  ability 
to  shoot  back.  Lethal  threat  suppression  systems  may  be 
carried  either  on  specialized  aircraft  (e.g.  "Wild  Weasel")  01 
on  one's  own  aircraft  and  include  various  means  of  delivering 
ordnance  on  target,  such  as  anti-radiation  missiles. 

An  emerging  use  of  digital  data  bus  systems  is  to  provide 
for  onboard  programming  of  threat  suppression  weapons.  Either 
onboard  or  off-board  sensors  can  be  used  to  provide  queuing  to 
the  threat  suppression  system,  which  can  then  program  the 
--’sapon  to  respond  to  the  specific  type  and  location  of  the 
threat.  This  capability  extends  the  tactical  utility  of  the 
threat  suppression  system. 
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G.  TACTICS 


The  sixth  and  last  susceptibility  reduction  concept  is 
tactics.  The  integration  of  multiple  sensors,  using  sensor 
fusion  techniques,  and  the  options  for  automatic  queuing  of 
expendables  and  threat  suppression  systems  are  contributing  to 
the  rapid  evolution  of  new  tactics.  As  an  example,  a  recent 
article  [Ref.  14]  reported  the  use  of  off-board  targeting 
(from  an  EA-6B)  to  provide  threat  information  in  support  of 
the  launching  of  a  threat  suppression  weapon  system  (an  F-16 
carrying  a  HARM  missile) .  The  aircraft  involved  made  use  of 
digital  data  buse_  and  a  digital  data  link  to  transfer 
information  among  the  various  systems. 
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IV.  VULNERABILITY  EFFECTS 


A.  VULNERABILITY 


Vulnerability  is  the  inability  of  the  aircraft  to 
withstand  the  damage  caused  by  the  man-made  hostile 
environment  [Ref.  3].  Each  of  the  components  in  the  aircraft 
has  a  degree  of  vulnerability  which  contributes  to  the  overall 
aircraft  vulnerability.  Components  whose  loss  of  function  or 
kill  mode  would  lead  to  the  kill  of  the  aircraft  are  referred 
to  as  critical  components  [Ref.  3:  p.  137].  A  kill  mode 
refers  to  the  reaction  of  the  component  or  system  when  hit, 
such  as  a  fire  or  explosion.  Identification  of  these  critical 
components  and  their  kill  modes  is  a  key  part  of  a 
vulnerability  assessment. 

B.  KILL  CATEGORIES 


The  discipline  of  aircraft  combat  survivability  provides 
definitions  for  the  aircraft  kill  categories,  further  divided 
into  two  sub-categories: 


•  Attrition,  where  the  aircraft  is  lost  to  inventory. 
There  are  four  levels  of  attrition: 

KK=  catastrophic  (immediate  loss  of  control) 

K=  loss  of  control  within  30  seconds  after  a  hit 
A=  loss  of  control  within  5  minutes  after  a  hit 
B=  loss  of  control  within  30  minutes  after  a  hit 

•  Mission  Abort,  where  the  aircraft  returns  to  base,  but 
does  not  complete  the  mission  due  to  combat  damage. 


Because  of  the  nature  of  electronics  devices,  combat  damage  is 
likely  to  result  in  either  the  immediate  loss  of  function  or 
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the  component  will  survive.  From  an  avionics  perspective,  the 
most  likely  causes  of  an  attrition  kill  would  be  by  damage  to 
the  flight  control  system  in  a  " fly-by-wire"  aircraft  or  to 
the  primary  flight  display  system  in  a  "glass  cockpit" 
aircraft.  Most  other  damage  to  avionics  is  more  likely  to 
result  in  a  mission  abort  kill  [Ref.  15:  P.  9]. 

C.  DAMAGE  MECHANISMS  AND  DAMAGE  PROCESSES 

A  damage  mechanism  is  the  output  of  the  warhead  that 
causes  damage  to  the  target,  sometimes  referred  to  as  a  kill 
mechanism  [Ref.  3:  P.  84],  For  an  avionics  system,  the  damage 
mechanisms  of  interest  include: 

•  penetrators/ fragments  (from  warheads  or  projectiles) 

•  blast,  incendiary 

•  electro-magnetic  pulse  (EMP) 

These  damage  mechanisms  cause  resultant  damage  processes,  such 
as  penetration  and  combustion,  when  they  interact  with  the 
aircraft.  Terminal  effects  refer  to  the  ultimate  response  or 
effect  of  the  damage  mechanism  on  the  aircraft  components. 

These  terminal  effects  can  lead  to  a  specific  kill  mode,  which 
is  defined  as  a  damage-caused  failure  of  a  component  [Ref.  3: 
p.  142].  Kill  modes  for  avionics  components  may  include: 

•  severing  (a  physical  break  in  a  wire) 

•  grounding  (signal  diverted  to  ground) 

•  corrupting  (signal  degradation  due  to  damaged  EM  shield 
or  EMP) 

•  loss  of  integrity  (crushed,  casing  penetrated,  etc.) 

•  overheating  (resulting  from  fire  or  explosion) 
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The  effect  of  these  damage  mechanisms  on  the  survival  of  the 
aircraft  varies  depending  on  the  criticality  of  the 
component (s)  affected. 


D.  VULNERABILITY  ASSESSMENT 


A  Vulnerability  Assessment  is  the  process  of  assigning 
numerical  values  for  the  various  measures  of  vulnerability, 
i.e.  vulnerable  area  [Ref  3:  p.153].  The  general  requirements 
for  conducting  a  vulnerability  assessment  are  [Ref.  3]: 

•  Select  a  kill  category  and  level 

■  Assemble  the  aircraft  technical  and  functional 
description 

•  Determine  the  critical  components  and  their  kill  modes 
for  the  selected  kill  category  and  level 

•  Select  the  threat 

•  Determine  the  critical  component  kill  criteria 

•  Compute  the  vulnerability  measure  for  the  selected 
threat  and  kill  category  and  level 

The  first  task  in  a  vulnerability  assessment  is  to  identify 
the  critical  component!  and  their  kill  modes.  Once  the 
critical  components  and  their  kill  modes  have  been  identified, 
a  vulnerability  assessment  can  be  conducted  to  quantify  the 
measures  of  component  and  aircraft  vulnerability,  expressed  in 
terms  of  vulnerable  area  to  a  specific  threat. 

The  vulnerability  assessment  is  typically  presented  in  a 
graphical  form,  known  as  either  a  "kill  tree"  or  "fault  tree". 
An  example  is  shown  as  Figure  6.  This  graphic  presentation 
method  is  used  by  survivability  engineers,  with  any  break  in  a 
vertical  line  joining  the  critical  components  representing  an 
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assumed  result  of  an  aircraft  kill.  This  is  a  variation  of 
survivability  logic  diagrams,  which  are  related  to  reliability 
(logic)  diagrams,  where  possible  failure  modes  and  outcomes 
are  displayed  in  a  logic  diagram.  In  reliability  engineering, 
damage  due  to  hostile  action  is  usually  excluded  from  the 
discussion. 

Vulnerability  is  expressed  in  relation  to  a  specific  man¬ 
made  threat,  such  as  23mm  High  Explosive  Incendiary  (HEI) 
shells.  For  most  aircraft,  there  will  be  areas  where  the 
aircraft  can  withstand  a  hit  by  a  23mm  HEI,  while  in  more 
critical  areas,  such  a  hit  could  damage  a  critical  component, 
leading  to  loss  of  the  aircraft.  The  vulnerable  area  (Av)  is  a 
theoretical  area  of  the  aircraft  which  is  presented  to  the 
threat  from  a  particular  direction  that,  if  hit  in  this  area, 
would  result  in  an  aircraft  kill  [Ref. 3:  p.154].  The  ratio  of 
the  aircraft's  vulnerable  area  to  its  presented  area 
represents  the  probability  that  the  aircraft  is  killed  given  a 
random  hit  on  the  aircraft  (Pk/h)  [Ref.  3:  p.154].  Once  the 
vulnerabilities  of  the  aircraft  are  understood,  design 
features  can  be  used  to  reduce  vulnerability. 

These  vulnerability  reduction  features  can  have  a  cost 
and  weight  penalty.  One  of  the  major  uses  of  the 
vulnerability  assessment  is  to  predict  the  probable  reduction 
in  aircraft  losses  ?n  the  event  that  the  aircraft  is  equipped 
with  specific  survivability  enhancement  features.  The  cost  of 
these  features  can  then  be  related  to  the  probable  cost 
savings  expressed  in  aircraft  and  aircrew  not  killed.  This 
information  can  then  be  used  to  support  a  decision  on  whether 
to  include  a  certain  vulnerability  reduction  feature,  or  not, 
based  on  the  anticipated  benefits  versus  the  probable  costs. 
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Figure  6,  Example  Kill  Tree  For  a  Two  Engine,  Two  Pilot 

Helicopter,  From  Ref.  3 

E.  CRITICAL  COMPONENTS 


The  general  definition  of  a  critical  component  is  one 
whose  loss  leads  to  a  loss  of  function  or  whose  kill  mode 
leads  to  an  aircraft  kill.  Also  considered  are  critical 
components  whose  loss  of  function  or  kill  mode  would  lead  to 
the  kill  of  another  critical  component  that  provides  an 
essential  function.  [Ref.  3].  Critical  components  may  be 
either  redundant  or  non-redundant . 

For  the  purposes  of  this  thesis,  the  focus  will  be  on  the 
critical  components  of  the  avionics  system,  especially  the 
data  buses.  In  general,  a  data  bus  consists  of  remote 
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terminals,  couplers  and  a  cable  (wire  or  fiber  optic) .  The 
data  buses  provide  for  the  connectivity  between  the  various 
avionics  devices.  These  avionics  devices  exist  as  remote 
terminals  on  the  data  buses. 

A  remote  terminal  can  be  a  critical  component,  depending 
on  the  function  that  the  individual  remote  terminal  performs. 
The  remote  terminal  that  functions  as  the  bus  controller  is  a 
critical  component  in  any  data  bus  that  uses  a  bus  controller 
protocol  (such  as  MIL-STD-1553B)  if  the  loss  of  this  data  bus 
will  lead  to  a  kill  of  the  aircraft.  The  loss  of  the  bus 
controller  or  its  functions  will  result  in  the  loss  of  all 
data  bus  functions,  unless  a  back-up  bus  controller  is 
available.  This  is  because  of  the  command/ response  design 
protocol  which  employs  a  bus  controller  to  de-conflict  the 
various  remote  terminals,  preventing  simultaneous 
transmissions  over  the  data  bus. 

Data  bus  couplers  and  associated  stubs  leading  to  remote 
terminals  are  of  different  design  for  each  of  the  three 
transmission  modes:  voltage-coupled,  current-coupled  and 
fiber-optic.  The  failure  of  a  coupler  located  between  the 
data  bus  cable  and  a  remote  terminal  that  is  a  critical 
component  could  result  in  the  loss  of  an  essential  function 
performed  by  that  component.  The  data  bus  couplers  in  a 
voltage-coupled  data  bus  are  designed  to  electrically  isolate 
individual  remote  terminals  trom  the  data  bus  and  are  unlikely 
to  directly  cause  a  data  bus  failure  (Figure  7) .  The  data  bus 
couplers  used  in  a  current  coupled  data  bus  are  extremely 
unlikely  to  directly  cause  a  data  bus  failure  because  they  do 
not  require  any  break  in  the  data  bus  cable  (Figure  8) .  The 
data  bus  couplers  used  in  a  fiber-optic  data  bus  could  cause  a 
data  bus  failure  if  badly  damaged.  Since  they  are  permanently 
fused  to  the  cable  and  have  no  moving  parts,  damage  to  the 
coupler  would  be  likely  to  simultaneously  damage  the  cable  by 
disrupting  the  light  path.  In  all  three  cases,  couplers  are 
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critical  components  if  the  remote  terminal  that  they  serve  is 
considered  to  be  a  critical  component. 


Bus  Shield 


Figure  7,  Data  Bus  Coupler,  Voltage-Coupled  (From  Ref.  6) 

The  cable  (wire  or  fiber-optic)  that  connects  the  various 
remote  terminals  is  another  critical  component,  if  the  loss  of 
the  data  bus  will  lead  to  a  kill  of  the  aircraft.  Severing  of 
the  wire  or  fiber-optic  cable  due  to  impact  by  a  penetrator  or 
by  secondary  means  (e.g.  fire,  explosion)  will  generally 
result  in  loss  of  data  bus  function.  Similarly,  loss  of  cable 
shield  integrity  will  be  likely  to  disable  the  wire  data  bus 
if  the  signals  are  diverted  to  ground  or  are  corrupted  by 
electro-magnetic  interference.  A  fiber-optic  data  bus  can 
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continue  to  function  with  a  damaged  shield  as  long  as  the 
light-transmitting  fiber  is  intact. 


COILS  AND  IWERMAL 


Figure  8,  Data  Bus  Coupler,  Current-Coupled  (From  Ref.  13) 


F.  LOSS  OF  FLIGHT  CONTROL  (ATTRITION)  RILL 

An  aircraft  with  a  "fly-by-wire”  or  "fly-by-light"  flight 
control  system  depends  upon  data  buses  to  provide  a  reliable 
data  path  for  the  flight  control  signals.  To  ensure  adequate 
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reliability,  three  or  four  data  buses  operating  in  parallel 
are  typically  used.  These  data  buses  provide  for 
communications  between  the  flight  control  computer,  inertial 
and  air  data  sensors,  flight  control  servos  and  other 
components  of  the  flight  control  system. 

The  critical  components  of  a  "fly-by -wire"  or  "fly-by- 
light"  flight  control  system  include: 

•  flight  control  computers 

•  flight  controls 

•  aircraft  motion  data  sensors  (INS,  GPS,  air  data) 

•  lata  buses 

•  flight  control  servos 

•  flight  control  power  systems  (hydraulic  or  electric) 

•  flight  control  surfaces 

From  the  perspective  of  the  avionics  system,  these  flight 
control  systems  can  be  disabled  by  the  following  kill  modes: 

•  disruption  of  the  control  signal  path 

•  loss  of  aircraft  motion  data  (for  unstable  aircraft) 

•  fire/explosion/overheating 

An  aircraft  kill  could  result  from  damage  to  the  control 
signal  paths  from  the  pilots’  flight  controls  to  the  flight 
control  computer (s) ;  damage  to  the  data  buses  from  the  flight 
control  computer  such  that  the  signals  cannot  reach  their 
intended  destination;  and  damage  to  aircraft  motion  data 
sensors  or  their  connection  to  the  flight  control  computer (s) . 
If  the  aircraft  is  an  unstable  aircraft,  such  damage  will  be 
likely  to  result  in  an  attrition  kill.  In  a  stable  aircraft, 
such  damage  may  result  in  a  mission  abort  kill,  assuming  that 
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there  is  a  functional  backup  control  system  which  provides  the 
aircraft  with  a  "get  home"  capability. 

Figure  9  shows  a  sample  "kill  tree'  that  presents  the 
critical  components  of  a  "fly-by-wire"  flight  control  system 
in  a  graphical  form  [after  Ref.  15].  The  kill  tree  for  the 
"fly-by-wire"  flight  control  system  shows  the  reduced 
vulnerability  of  the  system  that  results  from  the  use  of 
multiple,  redundant  data  buses  for  transmitting  the  flight 
control  signals.  However,  there  are  possible  single  point 
failures  for  the  flight  control  system  at  each  of  the  flight 
control  servo  locations  and  at  the  flight  control  computer 
(which  typically  ser  -es  as  the  bus  controller) .  This  is 
because  all  of  the  data  buses  are  in  close  proximity  at  these 
locations,  since  it  is  typical  for  all  of  the  data  buses  to  be 
used  for  pathways  from  the  flight  control  computer  to  each  of 
the  flight  control  servos.  A  hit  which  disables  the  flight 
control  computer (s) ,  or  a  hit  in  the  vicinity  of  the  servos 
could  conceivably  disable  all  of  the  data  buses  simultaneously 
since  cables  and  couplers  are  not  hardened. 

A  hit  that  causes  the  failure  of  any  of  the  critical 
components  of  an  individual  data  bus  (bus  controller,  cable 
and  couplers  to  other  critical  components)  could  lead  to 
failure  of  that  individual  data  bus.  Since  only  one  of  the 
other  data  buses  has  to  survive  in  order  to  maintain  system 
functionality,  a  minimum  of  one  failure  of  a  critical 
component  in  each  of  the  data  buses  would  be  necessary  to 
block  the  transmission  of  the  flight  control  signals  from  the 
flight  control  computer  to  the  servos. 

Figure  10  shows  a  sample  "kill  tree*  that  presents  the 
critical  components  of  a  "fly-by -wire"  flight  control  system 
data  bus  in  a  graphical  form  [after  Ref.  15]. 


393 


control  stick 


stabilator 

actuator 


Figure  9,  Flight  Control 


Kill  Tree 


F  C.  Computer 


dab  bus 
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Figure  10,  Flight  Control  Data  Bus  (Attrition)  Kill  Tree 
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G.  LOSS  OF  ENGINE  CONTROL  SYSTEMS  (MISSION  ABORT)  KILL 

In  general,  combat  damage  to  the  engine  electronic 
control  systems  will  be  unlikely  to  directly  result  in 
attrition,  with  a  mission  abort  being  a  much  more  likely 
outcome.  This  is  because  of  the  stand-by  or  manual  engine 
controls  that  are  typically  provided  to  give  the  pilot  a  "get 
home"  capability.  Loss  of  communications  between  the  engine 
control  systems  and  the  air  data  reference  systems  due  to 
damage  to  the  data  bus  is  one  possible  scenario  that  could 
lead  to  a  mission  abort.  The  critical  components  of  an  engine 
control  system  cc...  include: 

•  data  buses 

•  displays  (e.g.  CRTs  or  AMLCDs) 

•  display  drivers 

•  flight  reference  systems  (e.g.  air  data) 

•  throttles 

•  engine  control  computer (s) 

From  the  perspective  of  the  avionics  system,  these  can  be 
disabled  by  the  following  kill  modes: 

•  penetrator/ fragment  damage  leading  to  severing  or 
grounding 

•  fire/explosion/ overheating 

The  loss  of  an  element  or  various  elements  of  the  engine 
control  system  may  be  considered  sufficient  to  warrant  a 
mission  abort,  depending  on  the  nature  of  the  mission. 

The  "kill  tree"  for  the  engine  control  system  shows  the 
reliance  of  the  system  on  the  data  bus  or  data  buses  to  share 
information  and  to  manage  the  system.  See  Figure  11  for  a 
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sample  "kill  tree'  that  presents  these  critical  components  in 
a  graphical  form. 


Figure  11,  Engine  Control  System  (Mission  Abort)  Kill  Tree 


H.  LOSS  OF  FLIGHT  AVIONICS  (MISSION  ABORT)  KILL 


In  general,  combat  damage  to  the  flight  avionics  is 
unlikely  to  directly  result  in  attrition,  with  mission  abort 
being  a  much  more  likely  outcome.  This  is  because  of  the 
stand-by  or  secondary  flight  instrumentation  that  is  typically 
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provided  (e.g.  "peanut"  gyro),  even  in  a  "glass  cockpit" 
aircraft,  to  give  the  pilot  a  "get  home"  capability.  Loss  of 
communications  between  the  "glass  cockpit"  displays  and  the 
flight  reference  systems  due  to  damage  to  the  data  bus  is  one 
possible  scenario  that  could  lead  to  a  mission  abort.  The 
critical  components  of  a  flight  avionics  system  can  include: 

•  data  buses 

•  displays  (e.g.  CRTs  or  AMLCDs) 

•  display  drivers 

•  flight  reference  systems  (e.g.  gyros,  motion  sensors) 

•  central  computer (s) 

From  the  perspective  of  the  avionics  system,  these  can  be 
disabled  by  the  following  kill  modes: 

•  penetrator/ fragment  damage  leading  to  severing  or 
grounding 

•  fire/explosion/overheating 

The  loss  of  an  element  or  various  elements  of  the  flight 
display  system  may  be  considered  sufficient  to  warrant  a 
mission  abort,  depending  on  the  nature  of  the  mission  and 
environmental  conditions. 

The  "kill  tree"  for  the  flight  avionics  system  shows  the 
reliance  of  the  system  on  the  data  bus  or  data  buses  to  share 
information  and  to  manage  the  system.  See  Figure  12  for  a 
sample  "kill  tree'  that  presents  these  critical  components  in 
a  graphical  form. 
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Figure  12,  Flight  Avionics  (Mission  Abort)  Kill  Tree 

I.  LOSS  OF  TACTICAL  SENSOR  SYSTEMS  (MISSION  ABORT)  KILL 


In  general,  combat  damage  to  the  tactical  sensor  systems 
is  unlikely  to  directly  result  in  attrition,  with  mission 
abort  being  a  much  more  likely  outcome.  Loss  of 
communications  between  sensors  or  between  sensors  and  displays 
due  to  damage  to  the  data  bus  is  one  possible  scenario  that 
could  lead  to  a  mission  abort. 

The  critical  components  of  a  tactical  sensor  system  can 
include: 
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data  buses 


•  displays 

•  threat  warning  &  countermeasures  systems 

•  central  computer (s) 

•  sensors  (radar,  electro-optical,  etc.) 

•  electronic  warfare  systems 

From  the  perspective  of  the  avionics  system,  these 
tactical  sensor  systems  can  be  disabled  by  the  following  kill 
inodes : 


•  penetrator/ fragment  damage  leading  to  severing  or 
grounding 

•  fire/explosion/overheating 

The  loss  of  an  element  or  various  elements  of  the  tactical 
sensor  system  could  be  considered  sufficient  to  warrant  a 
mission  abort,  depending  on  the  nature  of  the  mission  and 
magnitude  of  the  expected  threat. 

The  "kill  tree"  for  the  tactical  sensor  system  shows  the 
reliance  of  the  system  on  the  data  bus  or  data  buses  to  share 
information  and  to  manage  the  system.  Figure  13  shows  a 
sample  "kill  tree'  that  presents  these  critical  components  in 
1  graphical  form.  Whenever  an  avionics  architecture  that 
incorporates  t..^  tactical  sensor  systems  via  a  data  bus  is 
used,  there  is  a  clear  requirement  for  one  or  more  backup  data 
buses  in  order  to  ensure  system  integrity  in  the  event  of 
damage.  Failure  of  any  individual  system  (e.g.  threat 
warning,  countermeasures,  radar,  etc.)  is  unlikely  to  lead  to 
a  mission  abort  in  all  cases.  However,  failure  of  the  entire 
data  bus  system  or  display  system  would  most  likely  result  in 
a  mission  abort.  A  crew  may  be  able  to  continue  the  mission 
with  a  single  sensor  system  disabled,  but  would  be  unlikely  to 
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continue  the  mission  with  a  complete  failure  of  all  tactical 
sensor  systems. 
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J .  ARCHITECTURES 


1.  Federated 

In  a  federated  avionics  system  architecture,  a  moderate 
degree  of  control  and  coordination  is  handled  by  a  central 
mission  computer.  The  individual  elements  of  the  system 
usually  have  dedicated,  independent  data  processors  and  are 
interconnected  via  data  buses,  typically  via  the  MIL-STD- 
1553B.  This  degree  of  interconnect ivity  allows  the  system 
elements  to  work  in  cooperation  and  to  share  information, 
which  is  the  major  advantage  of  the  federated  syst  m  over  the 
independent  architecture.  From  a  vulnerability  standpoint, 
there  are  two  weaknesses:  1)  reliance  on  a  central  computer 
for  control  and  coordination;  and  2)  reliance  on  shared  data 
that  is  distributed  via  interconnecting  data  buses. 

The  key  survivability  issue  for  a  federated  system  is  to 
ensure  uninterrupted  and  uncorrupted  communications  between 
the  various  avionics  systems  via  the  data  bus  or  buses.  Since 
the  different  systems  are  dependent  upon  a  common  data  base, 
any  break  in  this  flow  of  data  will  cause  system  degradation. 
The  exact  nature  of  the  degradation  will  be  dependent  upon  the 
individual  system  function  and  the  criticality  of  the  data. 

A  critical  component  for  a  federated  architecture  is  th 
central  computer  that  functions  to  coordinate  and  control  the 
various  system  elements.  Unless  a  backup  computer  is 
available,  this  can  represent  a  single  point  kill  for  the 
avionics  system.  With  the  central  computer's  functionality 
disabled,  the  interconnected  systems  may  be  unable  to  function 
independently . 

Similarly,  the  data  buses  used  to  connect  the  system 
elements  to  the  central  computer  are  critical  components. 
Disabling  all  of  these  data  buses  will  serve  to  isolate  the 


402 


central  computer  and  each  individual  system  element  from  the 
rest  of  the  system.  This  will  prevent  the  essential  flow  of 
shared  data  and  control  signals,  which  is  likely  to  result  in 
the  loss  of  much,  if  not  all,  of  the  functionality  of  the 
federated  system.  Figure  14  shows  the  critical  components  of 
the  federated  avionics  architecture. 
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Figure  14,  Federated  Architecture  Critical  Components,  After 
Ref.  1 


2.  centralized 

In  a  centralized  avionics  architecture,  the  main  elements 
of  the  avionics  system  are  packaged  in  standard  modules  which 
are  located  in  one  or  more  densely  packed  avionics  racks.  The 
system  elements  within  the  avionics  racks  are  interconnected 
by  means  of  high  speed  backplane  buses,  while  connections  to 
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the  various  sensors  and  displays  are  made  via  both 
conventional  and  high  speed  data  buses.  Because  the  computer 
processing  capabilities  of  the  integrated  architecture  are 
centrally  located  and  are  shared  among  various  elements,  the 
data  buses  must  be  capable  of  handling  a  very  high  data  rate. 
The  centralized  architecture  makes  extensive  use  of  common 
modules  and  the  sharing  of  the  computer  processors.  To  an 
even  greater  extent  that  the  federated  architecture,  the 
survivability  weaknesses  of  the  centralized  architecture  are: 
1)  nearly  total  reliance  on  a  central  processor  for  data 
processing,  control  and  coordination;  2)  close  proximity  of 
critical  co  \  onents  in  a  common  avionics  rack;  and  3)  reliance 
on  data  that  is  distributed  via  interconnecting  data  buses. 

This  architecture  may  have  two  major  disadvantages  in  a 
combat  environment:  1)  it  depends  on  many  long  data  buses  to 
collect  and  disseminate  both  data  and  command  signals  and  2) 
the  loss  of  the  single  or  co-located  central  computer (s)  could 
result  from  a  single  hit.  Since  the  other  elements  of  a 
centralized  system  are  largely  dependent  upon  the  central 
processing  unit(s)  for  inputs,  direction  and  coordination, 
loss  of  the  central  computer(s),  or  loss  of  communication  with 
the  central  computer ( s) ,  could  significantly  degrade  mission 
performance  even  to  the  extent  of  causing  a  kill  of  the 
aircraft. 

A  critical  component  for  an  centralized  architecture  is 
the  central  avionics  rack  that  contains  the  processing  modules 
which  function  to  process  data,  coordinate  and  control  the 
various  system  elements.  Since  the  design  co-locates  the 
backup  processors  in  the  same  or  an  adjacent  avionics  rack, 
this  can  represent  a  single  point  kill  for  the  avionics 
system.  With  the  centralized  processing  disabled,  the 
centralized  system  may  be  unable  to  function  unless  some 
backup  processing  capability  is  provided  in  another  location. 
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Similarly,  the  data  buses  used  to  connect  the  system 
elements  to  the  central  processors  are  critical  components. 
Disabling  these  data  buses  will  serve  to  isolate  the  central 
processors  from  the  individual  system  elements.  This  will 
prevent  the  essential  flow  of  data  from  the  sensors  to  the 
processors  and  from  the  processors  to  the  displays.  Without  a 
reliable  data  path,  the  functionality  of  the  integrated  system 
is  likely  to  be  compromised.  Figure  15  shows  the  critical 
components  of  the  centralized  architecture. 
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Figure  15,  Centralized  Architecture  Critical  Components,  After 
Ref.  1 

3.  Distributed 

The  distributed  architecture  is  similar  to  the  integrated 
architecture  in  the  use  of  common  modules  located  in  racks  or 
cabinets.  It  different  in  that  a  significant  amount  of  data 
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processing  is  accomplished  at  the  subsystem  or  element  level. 
Rather  than  being  located  at  a  single,  central  location,  the 
processors  are  distributed  throughout  the  aircraft  in  nodes. 

A  processor-intensive  element,  such  as  a  radar  or  electronic 
warfare  system,  will  typically  incorporate  a  significant 
preprocessing  capability  at  or  near  the  antenna  location. 

These  processor  nodes  are  interconnected  via  data  buses,  but 
are  capable  of  some  independent  operation. 

This  architecture  may  enjoy  several  advantages  in  a 
combat  environment,  including:  1)  less  reliance  on  data  buses; 
2)  intrinsic  partitioning  and  3)  residual  capability  should 
communication  with  other  system  elements  be  interrupted  [Re". 

1:  p.  6]. 

Critical  components  for  a  integrated  architecture  are  the 
avionics  racks  that  contain  the  processing  modules  which 
function  to  process  data,  coordinate  and  control  the  various 
system  elements.  Since  the  design  distributes  these  modules 
in  nodes  throughout  the  aircraft,  a  significant  survivability 
advantage,  there  may  be  no  single  point  kill  for  the  avionics 
system,  especially  if  the  system  can  be  dynamically 
reconfigured.  With  one  or  more  of  the  processing  nodes 
disabled,  the  distributed  system  may  be  able  to  continue  to 
function,  unless  some  essential  capability  is  lost. 

Similarly,  the  data  buses  used  to  interconnect  the 
processor  nodes  located  at  the  various  system  elements  are 
critical  components.  Disabling  these  data  buses  will  serve  to 
isolate  the  distributed  processors  from  the  each  other  and 
their  individual  system  elements.  This  will  prevent  the 
essential  flow  of  data  from  the  sensors  to  the  processors  and 
from  the  processors  to  the  displays.  Without  a  reliable  data 
path,  the  functionality  of  the  distributed  system  is  likely  to 
be  compromised.  In  a  similar  manner  as  with  the  centralized 
architecture,  redundant,  physically  separated  data  buses  can 
be  used  in  order  to  ensure  a  reliable  data  path  for  the 
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system.  Figure  16  shows  the  critical  components  for  a 
distributed  architecture. 


Figure  16,  Distributed  Architecture  Critical  Components,  After 
Ref.  1 
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V.  COMPUTING  THE  VULNERABLE  AREA  OP  AVIONICS  COMPONENTS 


A.  VULNERABILITY  ASSESSMENT 


As  a  part  of  the  vulnerability  assessment  (VA)  of  the 
aircraft,  it  is  necessary  to: 

•  Select  a  kill  category  and  level 

•  Assemble  the  aircraft  technical  and  functional 
description 

•  Determine  the  critical  components  and  their  kill  modes 
f ir  the  selected  kill  category  and  level 

•  Select  the  threat 

•  Determine  the  critical  component  kill  criteria 

•  Compute  the  vulnerability  measure  for  the  selected 
threat  and  kill  category  and  level 

For  the  flight  control  systems,  it  is  possible  to  conduct  a  VA 
assuming  either  an  attrition  or  a  mission  abort  kill.  For  the 
other  systems,  it  is  more  probable  that  a  mission  abort  kill 
will  be  appropriate  for  the  VA. 

The  technical  and  functional  descriptions  are  needed  in 
order  to  identify  the  aircraft’s  critical  components  and  to 
build  a  physical  model  of  the  component  locations.  Typically, 
a  computer  model  of  the  aircraft  that  shows  component 
locations  is  built  using  a  computer  aided  design  (CAD) 
software  package.  This  model  is  then  used  to  help  determine 
the  presented  areas  (Ap)  of  the  components.  In  combination 
with  the  probability  of  killing  a  component  given  a  hit  on  the 
component  (Pk/h) ,  the  vulnerable  area  (Av)  of  a  component  can 
be  determined  [Ref.  3:  p.1'58] . 

The  vulnerable  area  of  a  given  component  is  defined  as 
the  product  of  the  presented  area  (Ap)  in  the  plane  normal  to 
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the  approaching  damage  mechanism  and  the  probability  of  kill 
of  the  component,  given  a  hit  on  the  component  (Pk/h) .  In 
equation  form:  Av  =  (Ap) (Pk/h)  [Ref.  3:  p.  159).  Since  it  is 
extremely  time  consuming  to  compute  the  aircraft  vulnerability 
manually,  a  number  of  computer  programs  have  been  developed 
for  this  task. 

Two  types  of  computer  programs,  shotline  generators  and 
vulnerable  area  routines,  are  typically  used  sequentially  to 
conduct  a  vulnerability  assessment  of  an  aircraft  to  a  single 
hit  by  a  penetrator  or  fragment  [Ref.  3:  p.192).  The  shotline 
generator  programs  usually  model  the  exterior  surface  of  the 
aircraft  and  it--  components  with  e-.ther  surface  patches  or 
various  geometric  shapes.  The  program  then  superimposes  a 
planar  grid  over  the  aircraft's  surface  from  a  particular 
direction  and  passes  a  set  of  parallel  rays  or  shotlines 
through  the  aircraft,  one  shotline  being  randomly  located  in 
each  grid  cell.  The  shotlines  are  always  normal  to  the  grid 
plane  and  from  the  direction  of  the  threat  mechanism.  The 
program  traces  the  path  of  each  shotline  through  the  aircraft 
and  specifies  which  components  have  been  encountered  along  the 
shot line. 

The  vulnerable  area  routines,  of  which  COVART  is 
currently  the  state-of-the-art,  are  used  to  generate  component 
and  total  aircraft  vulnerable  area  tables  for  a  single 
penetrator  or  fragment  [Ref  3:  p.  194).  The  means  by  which 
this  is  accomplished  is  described  as  follows: 

"The  component  vulnerable  area  of  each  grid  cell  is 
the  product  of  the  cell  presented  area  and  the 
probability  of  component  kill  for  the  shotline  in 
that  cell.  The  vulnerable  area  of  each  component  is 
the  sum  of  the  component  vulnerable  areas  computed 
for  each  grid  cell  whose  shotline  passes  through  the 
component.  The  total  aircraft  vulnerable  area  is 
the  sum  of  all  the  cell  vulnerable  areas, 
considering  only  the  nonredundant  critical 
components  and  any  redundant  critical  component 
overlap."  [Ref  3:  p.  195] 
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Once  the  individual  aircraft  components'  probability  of 
kill  given  a  hit,  (Pk/h)  and  presented  area  (Ap)  have  been 
determined,  the  computer  methods  described  can  be  used  to 
estimate  the  overall  vulnerability  of  the  aircraft  to  a  given 
threat.  Because  of  their  small  size,  avionics  devices  make  a 
relatively  minor  contribution  to  the  overall  vulnerable  area 
of  a  typical  aircraft.  Large  vulnerable  components  such  as 
fuel  tanks,  engines  and  the  cockpit  usually  have  a  much 
greater  vulnerable  area  to  a  given  threat  than  the  avionics 
system.  However,  although  avionics  devices  are  small,  they 
are  frequently  critical  components  whose  loss  or  damage  could 
result  in  an  attrition  or  mission  abort  kill.  A  kill  in  most 
avionics  components  will  not  usually  result  in  an  aircraft 
kill,  but  may  lead  to  a  mission  abort.  The  decision  on 
whether  or  not  to  abort  must  take  into  account  the  specific 
mission,  threat  and  environmental  conditions,  since  different 
missions  have  different  levels  of  reliance  on  the  avionics 
system  [Ref.  16:  p.  9]. 

There  are  two  classes  of  critical  components  that 
generally  make  up  the  avionics  system,  the  "black  boxes"  (more 
formally  known  as  Line  Replaceable  Units  or  LRUs)  and  the 
wires  or  cables  that  interconnect  them.  Because  of  the  nature 
of  electronics  devices,  the  impact  of  a  projectile  or 
fragments  will  usually  either  produce  an  immediate  kill  of  the 
component  (LRU,  wire  or  cat_e)  or  the  unit  will  survive  [Ref. 
16] . 

B.  "BLACK  BOX"  VULNERABILITY 


The  design  of  a  typical  avionics  "black  box",  or  LRU,  is 
specified  in  applicable  civil  or  military  standards.  These 
standards  establish  the  form  factor,  external  design,  mounting 
and  environmental  operating  conditions  for  avionics  components 
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that  are  located  in  the  avionics  bay  of  an  aircraft  [Ref.  6: 
p. 139 ] .  Current  standards  include  ARINC  Specification  600 
[Ref.  17],  DOD-STD-1788  [Ref.  18]  and  MIL-M-28787  [Ref.  19]. 
Figure  6  shows  the  outline  drawing  of  a  DOD-STD-1788  LRU. 
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Figure  17,  DOD-STD-1788  LRU  (from  Ref.  6) 

The  aircraft  environment  is  typically  described  in 
precise,  quantitative  terms  for  the  use  of  the  avionics 
designer  [Ref  6:  p.  148],  The  specified  environment  usually 
includes  power,  cooling  and  ambient  air,  pressure, 
temperature,  vibration,  shock,  and  the  electromagnetic 
environment.  This  generally  assumes  a  benign  operating 
environment  and  does  not  typically  specify  the  possible  damage 
mechanisms  that  may  be  encountered  by  a  tactical  aircraft  in  a 
combat  environment.  The  survivability  requirements,  such  as 
ballistic  tolerance  to  a  given  threat  mechanism  (e.g.  7.62  or 
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12.7  mm  projectiles)  is  usually  included  in  the  overall 
aircraft  specification  since  survivability  is  applicable  to 
all  systems,  not  just  avionics. 

For  a  given  avionics  component  (LRU)  to  cease  to  perform 
its  intended  function  as  the  result  of  a  hit,  the  outer  case 
must  generally  be  penetrated  by  the  damage  mechanism 
(projectile  or  penetrator) .  This  hole  in  the  outer  casing 
destroys  the  electromagnetic  shielding  and  may  compromise  the 
forced  air  cooling  system.  Since  LRUs  are  typically  fairly 
densely  packed  with  circuit  cards  and  power  supplies,  the 
penetration  into  the  interior  of  the  LRU  will  cause  a  great 
deal  of  damaae  tc  these  fragile  -ssemblies.  Internal  health 
monitoring  routines,  such  as  built-in-test,  are  likely  to 
identify  the  failure  of  multiple  assemblies  within  the  LRU  as 
a  result  of  the  projectile  or  fragment  damage.  This  will  be 
likely  to  lead  to  a  self -commanded  shutdown  of  the  component, 
unless  this  function  is  itself  damaged.  It  is  also  possible 
that  an  electrical  fault  of  sufficient  magnitude  to  cause  a 
fuse  or  circuit  breaker  to  function  will  occur  as  a  result  of 
the  hit,  thereby  cutting  off  power  to  the  LRU.  The  kill  of  an 
electronics  component  after  a  hit  by  a  projectile  or  fragment 
is  likely  to  be  immediate  (less  than  one  second)  [Ref.  16:  p. 
10] . 

In  the  case  of  an  explosive  warhead,  such  as  a  23mm  HEI 
round,  the  effeccs  on  the  LRU  are  devastating.  Internal 
circuit  card  assemblies  are  temperature  sensitive  and  the  heat 
of  the  explosion  is  very  likely  to  destroy  the  items  located 
in  the  interior  of  the  LRU.  The  probability  of  kill  for  such 
a  warhead  is  likely  to  approach  unity. 
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C.  CABLE  VULNERABILITY 


Since  avionics  components  are  typically  connected  via 
cables  or  wires,  the  vulnerability  of  these  cables  and  wires 
to  damage  by  projectiles  and  fragments  is  a  significant 
concern.  Recent  testing  under  the  sponsorship  of  the  Air 
Force  [Ref:  20]  has  provided  a  great  deal  of  information  about 
the  effects  of  projectile  and  fragment  damage  on  wire  bundles 
and  cables.  A  major  reason  for  concern  about  these  effects  is 
that  damage  to  cables  and  wire  bundles  is  difficult  to  locate 
and  repair.  While  circuit  breakers  and  fuses  can  bt.  expected 
to  protect  the  various  avionics  components,  shorting  to  ground 
and  arcing  can  be  expected  to  result  from  the  impact  of  a 
damage  mechanism  (projectile  or  fragment)  on  the  wires  or 
cable  [Ref  20:  p.  1].  In  addition  to  disabling  the  power, 
control  or  signal  path,  the  current  carried  by  the  severed 
cable  presents  a  possible  source  of  ignition  for  secondary 
fires  or  explosions. 

When  computing  the  vulnerable  area  of  the  aircraft,  the 
contributions  of  the  cables  and  wire  bundles  must  be  included 
since  the  loss  of  power  or  signals  to  a  critical  component  is 
essentially  equivalent  to  the  loss  of  the  component  itself. 
While  small  in  diameter,  ..lany  wire  bundles  and  cables  have  a 
large  presented  area  because  of  their  length.  Most  shotline 
generator  computer  programs  conclude  that  a  cable  or  wire  is 
damaged  by  a  projectile  or  fragment  only  if  the  centerline  of 
the  projectile  or  fragment  passes  through  the  cable  or  wire. 
This  can  lead  to  an  underestimation  of  the  vulnerable  area, 
since  penetration  of  the  outer  shielding  that  exposes  the 
conductors  is  sufficient  to  cause  damage  and  in  many  cases  it 
is  not  necessary  to  completely  sever  the  cable  or  wire  to  have 
damage  occur.  This  effect  is  shown  in  Figure  18.  Flint 
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[Ref.  20]  proposes  that  a  radius  addition  be  added  to  all  wire 
bundles  and  cables  in  order  to  compensate  for  the  shotline 
methodology  currently  in  use.  This  would  increase  the 
probability  of  a  hit  being  recorded  on  a  given  cable  or  wire 
bundle  and  would  correct  for  the  currently  understated  number 
of  hits  that  results  from  the  shotline  methodology  in  use. 

This  should  result  in  an  increased  presented  area  and  a 
corresponding  increase  in  vulnerable  area  a  result  of  the 
contribution  of  the  cables  and  wire  bundles  to  the  avionics 
system  vulnerable  area. 


CASE  3  case  $  CASE  5 
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Figure  18.  Effects  of  Fragment  Size  and  Offset  (from  Ref. 20) 


414 


VI.  VULNERABILITY  REDUCTION  IN  AVIONICS  DESIGN 


Digital  avionics  systems  can  contribute  positively  to  the 
survivability  of  a  tactical  aircraft  in  many  ways,  including 
reducing  the  susceptibility  of  the  aircraft  (making  the 
aircraft  harder  to  hit)  and  reducing  the  vulnerability  of  the 
aircraft  (making  it  harder  to  kill,  if  hit).  Susceptibility 
factors  were  covered  in  Chapter  III.  Chapter  IV  discussed 
vulnerability  effects  for  the  most  common  types  of  avionics 
systems,  with  the  exception  of  computer  systems.  Since  the 
computer  systems  are  of  critical  importance  to  all  of  the 
other  avionics  systems  (e.g  flight  control  systems,  engine 
control  systems,  flight  avionics  systems  and  tactical  sensor 
systems) ,  the  computer  systems  were  not  treated  separately. 

The  following  chapter  presents  the  six  vulnerability  reduction 
concepts  as  applicable  to  avionics  systems. 


A.  VULNERABILITY  REDUCTION  CONCEPTS 


Vulnerability  reduction  is  defined  as  the  use  of  any 
design  technique  or  equipment  to  control  or  reduce  the  amount 
of  damage  or  the  consequences  of  damage  to  the  aircraft,  when 
the  aircraft  is  hit  by  one  or  more  damage  mechanisms  [Ref.  3]. 
The  six  vulnerability  reduction  concepts  are  [Ref.  3]: 

•  Component  Redundancy  (with  separation) 

•  Component  Location 

•  Passive  Damage  Suppression 

•  Active  Damage  Suppression 

•  Component  Shielding 

•  Component  Elimination 
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Each  of  these  vulnerability  reduction  concepts  may  used  to 
improve  the  survivability  of  the  avionics  systems. 

1.  Component  Redundancy  (With  Separation) 

Component  redundancy  refers  to  the  use  of  multiple 
devices,  parts  or  mechanisms  to  perform  a  given  task  [Ref  3]. 
Systems  may  be  designed  with  total  redundancy  or  only  partial 
redundancy.  A  choice  also  exists  between  actual  redundancy, 
using  identical  devices,  parts  or  mechanisms,  or  functional 
redundancy  only.  The  use  of  multiple,  redundant  data  buses  in 
parallel  is  an  example  of  actual  redundancy  using  identical 
components.  The  requirement  for  physical  separation  of  the 
redundant  devices,  parts  or  mechanisms  is  intended  to  prevent 
the  redundant  items  from  being  killed  by  a  single  event.  For 
example,  it  would  be  considered  good  design  practice  to  route 
the  multiple  redundant  data  buses  as  far  apart  from  one 
another  as  possible,  within  the  constraints  of  the  aircraft 
structure.  When  the  data  buses  are  routed  on  opposite  sides, 
damage  to  one  side  of  the  aircraft  alone  would  be  unlikely  to 
result  in  loss  of  all  data  bus  functionality. 

2 .  Component  Location 

Component  location  means  the  choice  in  the  design  phase 
to  position  a  component  such  that  a  damage  mechanism  is  less 
likely  to  kill  the  component  [Ref.  3].  Good  design  techniques 
applicable  to  improved  survivability  of  avionics  devices 
include: 

•  Orienting  a  component's  presented  area  to  reduce  the 
likelihood  of  being  hit  by  a  damage  mechanism  coming 
from  the  most  probable  direction. 

•  Locating  noncritical  or  ballistically  hardened 
components  in  front  of  more  vulnerable  components. 
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•  Reducing  the  presented  area  of  non-redundant 
components . 

•  Locating  components  in  order  to  prevent  cascading 
damage . 

In  the  case  of  a  ground  attack  aircraft  tasked  with  close  air 
support,  it  would  be  good  design  practice  to  avoid  locating 
critical  components  near  the  bottom  of  the  aircraft,  since 
this  is  the  direction  where  the  majority  of  damage  mechanisms 
are  likely  to  be  coming  from.  For  aircraft  that  use  a  central 
avionics  bay,  the  demands  for  easy  access  for  maintenance  must 
be  traded  off  with  the  need  for  survivability  in  locating  the 
critical  avionics  components.  For  most  aircraft,  he  trend 
towards  component  miniaturization  aids  aircraft  survivability 
by  reducing  the  presented  area  of  critical  components,  thereby 
reducing  the  aircraft's  vulnerable  area. 

.3.  Passive  Damage  Suppression 

Passive  damage  suppression  refers  to  features  that  either 
contain  the  damage  or  reduce  the  effects  of  the  damage  when  an 
aircraft  encounters  a  damage  mechanism  [Ref.  3].  Good  design 
techniques  applicable  to  improved  survivability  of  avionics 
devices  include: 

•  Damage  Tolerance 

•  Ballistic  Resistance 

•  Delayed  Failure 

•  Fire  and  Explosion  Suppression 

•  Fail-Safe  Response 

Most  avionics  components  are  composed  of  printed  circuit  cards 
and  their  associated  power  supply  and  backplane,  located  in  a 
housing  ("black  box")  that  functions  as  an  environmental 
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shield  from  dust,  water,  and  electromagnetic  interference  and 
provides  a  channel  for  cooling  air.  The  "black  box"  is 
typically  optimized  for  light  weight  and  small  size,  with 
ballistic  resistance  rarely  being  a  consideration. 
Vulnerability  reduction  techniques  available  to  the  avionics 
designer  include  the  use  of  materials  that  are  tolerant  of  the 
loss  of  the  integrity  of  the  environmental  shield  that  is  the 
component  housing.  The  key  passive  damage  suppression 
technique  for  avionics  is  to  ensure  that  components  are  able 
to  be  easily  isolated  via  circuit  breakers,  preventing  a 
"cascade"  failure  to  the  system. 

4.  Active  Damage  Suppression 

Active  damage  suppression  is  a  technique  that  employs  a 
sensor  or  other  device  to  sense  the  onset  of  a  damage  process 
and  activates  some  mechanism  that  contains  the  damage  or 
reduces  its  effects  [Ref. 3].  The  chief  example  of  this  type 
of  technique  is  a  fire  detection  and  extinguishing  system. 
Since  avionics  devices  are  generally  very  sensitive  to  damage 
by  fire  or  overheating,  the  use  of  fire  suppression  devices  in 
avionics  bays  could  improve  their  survivability. 

5.  Component  Shielding 

Component  shielding  refers  to  the  technique  of  using 
coatings  or  materials  that  resist  or  absorb  the  damage 
mechanisms  [Ref.  3].  The  use  of  armor  is  the  most  common 
example  of  this  technique.  Here  the  design  tradeoff  is 
between  the  weight  of  the  shielding  and  the  necessary  level  of 
ballistic  tolerance.  Since  most  avionics  devices  are  not 
themselves  in  hardened  housings,  this  technique  is  usually 
applicable  to  shielding  around  the  avionics  bay.  To  save 
weight,  the  shielding  is  usually  installed  in  only  the  most 
probable  direction  for  the  given  damage  mechanism. 
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6.  Component  Elimination 


Component  elimination  refers  to  the  design  choice  of 
either  eliminating  a  component  entirely  or  replacing  it  with 
another,  less  vulnerable,  component  [Ref.  3],  An  example  for 
an  avionics  component  would  be  to  choose  a  passively  cooled 
component  over  one  which  relies  on  forced  air  cooling,  since 
this  reduces  the  component's  vulnerability  to  damage  should 
cooling  air  supplies  be  lost. 


B.  CHOICE  OP  AVIONICS  ARCHITECTURE 


The  avionics  designer  has  a  choice  of  three  main  avionics 
architectures:  federated,  centralized  and  distributed.  Each 
is  highly  dependent  upon  the  uninterrupted  flow  of  data  via 
the  digital  data  buses  and  on  computer  processing  capability. 
The  vulnerability  reduction  concepts  applicable  to  each 
architecture  are  discussed  below. 

1.  Federated 

The  federated  system  can  be  designed  to  be  more 
survivable  by  providing  physically  separated  backup  data  paths 
using  multiple  redundant  data  buses  with  backup  bus 
controllers  and  a  backup  central  computer.  The  use  of 
multiple,  interconnected  data  buses,  each  of  which  is 
dedicated  to  a  particular  function,  can  provide  a  degree  of 
compartmentalization.  The  physical  placement  of  the  data  bus 
cables  should  be  as  widely  separated  as  possible,  within  the 
constraints  of  the  aircraft  design.  The  goal  is  to  assure  the 
reliable  transmission  of  data  between  the  various  remote 
terminals  in  the  system  in  order  to  maintain  system  integrity 
and  functionality. 
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2.  Centralized 


The  centralized  system  can  be  designed  to  be  more 
survivable  by  providing  backup  data  paths  using  multiple 
redundant  data  buses,  either  with  backup  bus  controllers  or  by 
using  newer  data  bus  designs  that  do  not  rely  on  bus 
controllers.  The  physical  placement  of  the  data  bus  cables 
should  be  as  widely  separated  as  possible,  within  the 
constraints  of  the  aircraft  design,  but  all  must  converge  at 
the  central  avionics  rack(s) .  The  use  of  a  centralized, 
integrated  processing  capability  it. -^ans  that  it  is  nearly 
impossible  to  duplicate  this  capability  in  a  physically 
separate  location.  Hence,  the  central  processing  and  data 
distribution  systems  must  be  protected  from  damage  in  order  to 
ensure  survivability  of  the  system.  Hardening  and/or 
shielding  of  the  co-located  group  of  critical  components  is 
the  most  likely  vulnerability  reduction  concept  to  be 
effective  without  compromising  the  economic  advantages  of  the 
centralized  architecture. 

3.  Distributed 

From  a  survivability  perspective,  it  can  be  argued  that 
the  distributed  architecture  is  preferable  because  damage  at 
any  single  site  should  be  unaole  to  disable  all  systems.  The 
remaining  processing  capability  may  be  sufficient  to  enable  a 
degree  of  system  functionality  even  after  some  damage  has  been 
inflicted.  Still,  the  information  that  is  shared  over  the 
data  buses  could  be  interrupted  due  to  damage,  even  if 
individual  systems  are  capable  of  functioning.  The  impact  of 
interrupting  the  data  flow  would  be  likely  to  impede  continued 
system  operation,  making  the  availability  of  redundant  data 
paths  an  essential  consideration  for  a  distributed 
architecture,  just  as  it  is  for  the  federated  and  centralized 
architectures . 
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VII.  CONCLUSIONS 


In  the  design  of  a  modern  tactical  aircraft,  which  is 
highly  dependent  upon  digital  avionics  systems  for  its  mission 
performance,  attention  should  be  paid  to  the  survivability  of 
the  avionics  systems  when  the  aircraft  is  operated  in  a  man¬ 
made  hostile  environment.  The  traditional  considerations  of 
reliability,  fault  tolerance  and  component  redundancy  that 
take  into  account  known  or  anticipated  failure  modes  of  the 
avionics  systems  should  be  augmented  by  consideration  of  the 
catastrophic  effects  of  combat  damage. 

For  most  common  combat  threats,  damage  to  the  avionics 
system  is  more  likely  to  result  in  a  mission  abort  kill  than 
an  attrition  (loss  of  aircraft)  kill.  However,  an  unstable 
fly-by-wire  aircraft  could  be  attrited  if  the  damage  is 
sufficient  to  disable  the  flight  control  system.  There  may  be 
an  interesting  parallel  in  the  design  of  some  fly-by-wire  . 
systems  to  the  hydraulic  system  design  that  was  typically  used 
in  the  1960s.  At  that  time,  all  of  the  hydraulic  systems  were 
generally  routed  to  each  of  the  servo  actuators.  In  combat, 
this  proved  to  be  undesirable  in  that  a  single  massive  hit  to 
the  servo  area  could  knock  out  all  of  the  aircraft  hydraulic 
systems  simultaneously.  In  some  fly-by-wire  designs,  all  of 
the  data  buses  used  to  send  flignt  control  commands  to  the 
servos  are  likewise  connected  to  each  servo.  It  is  possible 
that  a  single  massive  hit  to  the  servo  area  could  sever  all  of 
the  data  bus  cables  and  disable  all  of  the  flight  control  data 
streams  simultaneously,  resulting  in  loss  of  control.  Another 
possible  single  point  failure  is  the  flight  control  computer 
in  an  unstable  aircraft.  In  some  aircraft  designs,  the 
central  flight  control  computer  has  such  a  major  role  in  the 
flight  control  system  that  a  disabling  hit  to  this  component 
will  result  in  the  loss  of  control,  regardless  of  pilot  input. 

The  majority  of  possible  kill  modes  of  avionics 
components  will  lead  to  a  mission  abort  kill.  The  decision  on 
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whether  or  not  to  abort  must  take  into  account  the  specific 
mission,  threat  and  environmental  conditions,  since  different 
missions  have  different  levels  of  reliance  on  the  avionics 
system.  As  modern  tactical  aircraft  become  increasingly 
reliant  on  their  avionics  systems,  the  contribution  of  these 
systems  to  the  vulnerability  of  the  aircraft  is  likely  to 
increase. 

It  is  probable  that  as  more  combat  data  is  available,  the 
survivability  effects  of  digital  avionics  systems  will  be 
better  understood.  For  now,  the  fact  that  avionics  systems 
represent  30-40  percent  of  the  aircraft  fly-away  costs, 
although  only  3-6  p  rcent  by  weigh! ,  dictates  that  a  cautious 
approach  to  the  effects  of  digital  avionics  systems  on  the 
survivability  of  modern  tactical  aircraft  be  pursued. 
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BRIEFING  SYNOPSIS: 


INTEGRATED  SURVIVABILITY  ASSESSMENT: 

MEASURING  THE  BALANCE 

DAVID  H.  HALL 
NAWCWPNS 

Measuring  the  balance  between  vulnerability  and  susceptibility 
technologies  is  a  critical  element  in  designing  aircraft  for 
survivability.  But  in  order  to  measure  that  balance,  a  complete  set  of 
credible  analytical  tools  needs  to  be  available  and  accepted  within 
the  Joint  Service  community. 

A  workshop  was  held  in  May  of  this  year,  in  Albuquerque,  NM, 
whose  objectives  were:  developing  a  common  definition  of  Integrated 
Survivability  Assessment  (ISA),  identifying  customer  requirements 
for  survivability  assessment,  determining  the  need  for  ISA 
capabilities,  understanding  the  contribution  to  those  requirements 
from  ongoing  initiatives  (such  as  JMASS  and  HLA),  identifying 
shortfalls,  and  developing  the  start  of  a  roadmap  for  the  JTCG/AS  to 
fill  those  shortfalls.  This  briefing  will  discuss  the  results  of  the 
workshop  and  their  application  to  Joint  survivability  methodology 
development  “into  the  next  century.” 

A  fairly  significant  number  of  “customers”  at  the  workshop  indicated 
that  they  require  the  ability  to  assess  the  military  worth  of  weapons 
systems,  and  that  survivability,  as  one  part  of  an  integrated 
assessment,  needs  to  be  addressed  in  a  mission  context.  The  ISA 
Workshop  developed  a  list  of  requirements  for  the  JTCG/AS  to 
pursue,  including  the  credibility  of  engagement  level  simulations 
(including  Pk),  mission  level  survivability  modeling,  and  the 
inclusion  of  mission  effectiveness  and  cost  assessment  in  the  analysis 
process.  The  output  of  the  workshop  provided  guidance  for  defining 
the  elements  to  include  in  a  roadmap  for  future  JTCG/AS  activities,  as 
well  as  actions  to  take  with  regard  to  JMASS  developments  and  HLA. 
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INTEGRATED  SURVIVABILITY  ASSESSMENT  (ISA) 

PLAY  ALL  THIS  n  AGAINST  ALL  THIS  n  AND  SEE  WHO  SURVIVES 
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Concern  that  M&S  results  are  seen  as  “the  answer” 

-  M&S  are  one  tool  out  of  many  that  provide  information  to  analysts 

-  Analysts  cannot  be  viewed  as  “data  entry  clerks”  once  authoritative 
databases  and  models  developed 
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Workshop  participation,  funding  participation 
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Major  Accomplishment:  Land  with  Failures 
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Increased  aircraft  survivability 
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Combat  Damage  Reduction 
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Halon  Protects  Aircraft  from  fire  Halon  is  also  used  in  other  applications 
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Repair  of  Advanced  Structures 

•Computerized  Wiring  Maintenance  Aid 
•Transparency  Repair  System 


hypervelocity 
IMPACT  STUDIES 


METHODOLOGY  IMPROVEMENTS 


Physics  based 
Good  database 
Realistic  requirements 


Propulsion  Controlled  Aircraft:  A  Safety  and 
Survivability  Enhancement  Concept 

Frank  W.  Burcham,  Jr,  and  Joel  Sitz,  NASA  Dry  den  Flight  Research  Center 

John  Bull,  Caelum  Corporation,  NASA  Ames  Research  Center 

Paper  for  the  American  Defense  Preparedness  Symposium  on  Enhancing 
Aircraft  Survivability,  Oct  21-23,  1997,  Naval  Post  Graduate  School 


Modern  aircraft  with  today's  advanced  technology  have  achieved  an 
astounding  safety  record.  However,  as  the  number  of  operations  continues  to 
increase,  we  need  to  continue  to  examine  methods  to  survive  extremely 
unlikely  failure  scenarios.  Triggered  by  the  Sioux  City  accident,  we  at  NASA 
Dryden  have  been  looking  at  flying  airplanes  that  have  lost  all  flight  controls. 
Such  a  loss  could  occur  not  only  from  battle  damage,  but  from  uncontained 
engine  failure,  mid-air  collision,  terrorist  bomb  or  missile,  structural  failure 
and  control  system  failure. 

Flight  control  using  only  manual  throttle  control  has  been  extensively 
studied.  Our  results  substantiate  the  experience  of  The  flight  232  crew;  that 
manual  throttle  control  landings  range  from  very  difficult  to  impossible, 
depending  on  the  aircraft  configuration.  NASA  Dryden  developed  what 
came  to  be  called  the  Propulsion  Controlled  Aircraft  or  PCA  system,  using 
computerized  control  of  engine  thrust,  and,  with  PCA,  safe  landings  are 
possible  for  many  airplanes.  Flight  tests  of  an  F-15  and  an  MD-11  have 
demonstrated  landings  without  the  use  of  any  of  the  normal  flight  controls. 

In  addition,  a  PCA  system  was  developed  at  NASA  Ames  and  has  been 
proven  on  a  high  fidelity  simulation  of  the  B-747.  and  by  Boeing  on  a  C-17 
simulation  have  also  shown  safe  landing  capability. 

These  PCA  systems  used  full  authority  control  of  the  engines,  and  thus  would 
require  digital  engine  controls  and  modifications  to  the  engine  control 
software.  In  the  new  NASA  spirit,  we  looked  at  Faster  -  Cheaper  and  maybe 
good  enough  variations  on  the  PCA  theme.  Pitch  control  may  be  adequately 
provided  by  driving  the  engines  through  the  autothrottle  system  that  exisits 
on  many  of  today's  airplanes.  On  the  B-747-400,  using  the  autothrottle 
system  and  the  existing  5%  digital  engine  trim  capability,  safe  landings  could 
still  be  made.  We  call  this  PCA-Lite.  It  worked  well  in  turbulence  levels  to 
light-to-moderate  and  crosswinds  to  10  knots. 

For  airplanes  with  autothrottles  but  without  digital  engine  controls,  we 
looked  at  whether  the  pilot  could  manually  manipulate  the  throttles  to 
provide  the  differential  thrust  for  lateral  control.  On  the  B-747  simulator,  the 
answer  was  clearly  yes;  this  became  "PCA  Ultra-lite".  On  the  MD-11 
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simulator,  with  the  engines  more  inboard,  results  were  not  as  good. ..the 
landing  were  probably  all  survivable,  but  it  was  very  difficult  to  land  on  the 
runway  because  of  the  sluggish  lateral  control  capability  with  manual  thrust 
control.  This  concept  is  just  starting  to  evolve,  and  more  airplanes  need  to  be 
examined. 

For  the  really-really-really  bad  day  where  you  lose  flight  controls  and  also  lose  a  wing 
engine,  if  only  the  engine  or  engines  on  one  wing  were  still  operating,  would  there  be 
any  possibility  of  providing  emergency  flight  control?  In  response  to  this  potential 
situation,  NASA  Dryden  has  taken  a  first  look  at  a  concept  that  shows  that  one  engine 
can  provide  limited  flight  control  capability  if  the  lateral  center  of  gravity  (CGY)  can  be 
shifted  toward  the  side  of  the  airplane  that  has  the  operating  engine.  Limited 
simulation  tests  with  all  conventional  flight  controls  inoperative  and  a  wing  engine 
inoperative  on  the  MD-11  have  shown  positive  flight  control  capability  within  the 
available  range  of  lateral  CG  offset.  On  4-engine  airplanes,  simulations  of  the  B-720  at 
NASA  Dry  "  an,  and  the  B-747  at  NASA  Ames,  have  also  shown  positive  control 
capability  within  the  available  range  of  CGY  offset. 

Overall,  the  response  of  engines  as  flight  controllers  has  been  adequate.  Transport 
engines  are  slower  to  respond,  but  those  airplanes  also  have  slower  dynamics;  the  net 
result  has  been  that  engine  response  has  been  fast  enough  to  damp  aircraft  dynamics. 
There  have  been  cases  where  the  thrust  level  was  near  idle  and  engine  response 
became  very  slow,  particularly  for  landings  with  no  flaps.  Shallower  glideslope 
approaches  helped  this  problem. 

In  summary,  engine  thrust  can  be  used  for  airplane  flight  control.  Manual  thrust 
control  is  OK  for  continuing  flight,  but  is  not  adequate  for  landing.  A  system  that  uses 
computer-controlled  thrust  has  been  shown  to  provide  safe  landing  capability  for 
fighter  and  transport  airplanes.  Simplified  versions  of  this  PCA  system  have  also  been 
studied  recently,  and  also  show  promise  for  emergency  landings. 


591 


I  65 


T3 

0 

0 

3 

0 

o 

CO 

■t— > 

c 

CD 

T3 

o 

o 

CO 


CO 

1- 

o 

X- 

"co 

CO 

3 

o 

X- 

0 

E 

3 


o 

o 

XJ 

CD 

U) 

cc 

O) 

u> 

CO 

A 


O 

Cfl 

Cl> 

vu 

0) 

jsc 

4-* 

£ 

A 

CC 

o 

X3 

A 

cc 

fl) 

X3 

o 

>> 

O 

0 

CD 

£ 

4-» 

g> 

‘&Z 

0 

CL 

4-» 

LL 

< 

■> 

c 

T3 

£ 

0 

«£ 

0 

o 

0 

XI 

G 

m 

X- 

0 

E 

o 

1 

O 

0 

v_ 

0 
>4— < 
4-> 

O) 

£ 

O 

L 

CL 

o 

n 

0 

CL 

v\ 

-1 

T” 

m 

*t— ■ 

O 

0 
■  ■■■ 

X 

m 

cn 

0 

0 

1— 

3 

CM 

LO 

■ 

1 

o 

1- 

CD 

LL 

‘ 

>» 

• 

• 

• 

CO 

4- 

o 

3 

v. 

•*-* 

Cfl 

T3 

£ 


£ 

CO 

Q. 

CO 


h- 

^r 

■ 

CQ 


< 

“3 


cc 


V) 

5_ 

0) 

XI 

XJ 

3 


CC 

O 


0) 

> 

■*-* 

w 

o 


CO 

"O 

X- 

(0 

£ 

T3 

LU 

O 

■ 

CD 

X 


cc 

H- 

0) 

c 

’cn 

c 

cu 

xj~ 

3* 


o 

X 

3 

O 

c 75 


■ 

o 

Q 


< 

D 


CO 

M— 

o 

3 

i— 

*■» 

cn 

XJ 

> 

A 


E 

CO 

c 

HM 

CD 

> 

in 

6 


CC 

C> 

XJ 

> 

A 

CO 

£ 

CO 

■  mmt 

T3 

£ 


Cfl 

3 

_o 

d 

CO 

> 

CO 

0 

CO 

(0 

O 


£ 

to 

£ 

+-* 

0 
*  amm 

> 

< 

LU 

CO 


Np 

o'- 

00 


a> 

3 

TO 

h* 

O 

> 

(/) 

o 

LL 

£ 

0 

a 

0 

“D 


oo  oo 

T—  T“ 

LL  li 


0 

£ 

0 

V- 

O 

0 

£ 

O 

ummm 

4-i 

a 

0 

a 

x 

0 


0 

CO 

3 

0 

O 

0 

n 

co 

£ 

0 

■a 

o 

o 

0 

+-* 

o 

£ 


Cfl 

0) 

A 

CC 

O 

< 

< 


A 

CC 

w 

XJ 

a> 

E 

E 

iS 

”3 


2  £ 

0  £: 

£  ° 
4-* 

0  CO 


0  0 
■O  CO 

i  2 

Z  o 

0  T- 


X 

< 


J* 
(0 
a) 

X! 
£ 

CD 
LL 

< 
— 1  0 

S  -- 

_  .Q 
Z  13 
O 
CC 

*\ 

o 

CM 

in 

l 

CD 


^  CN. 

i-S 

(csV. 

© 

0=3 


© 

&=□ 

© 


□cn 

0=3 


O 

i 

_i 

0 

4-» 

0 

D 


(35) 

C= 


0 

E 

0 

4-> 

0 

>* 

0 


o 

O 

4-> 

.£ 

O) 


Q. 

3 

.X 

O 

0 

O 


£ 

0 

E 

Q. 

O 

0 

> 

0 

T3 

~o 

£ 

0 


0 

0 

0 

0 

x- 

0 

O) 

0 

i_ 

3 

O 

O 

£ 

LU 


O 

g 


t4*w£ 


£ 

0 

0 

N 


°  z 


0 

j= 

4-» 

0 

0 

£ 

0 

a 

V. 

0 

> 

T3 

O 

JQ 

i 

0 

T3 


■D 

0 


0 

O 

> 

s5 

0 

£ 


power  separate  from  that  source  used  for  the  conventional  control  system 


To  climb,  add  thrust  on  the  wing  engines 


NASA  Dryden  Flight  Research  Center  96-113- 
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Something  else  needed  for  safe  runway  landings 


Propulsion  Controlled  Aircraft  (PCA)  -  F-15  Results 
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Software  changes  to  existing  systems 
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MD-11  PCA  Landing 
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Boeing  request  for  aft  CG  cases  tested 
Faster-cheaper  PCA  concepts  tested 


B-747  PCA  Landing 

No  hydraulics,  no  flaps, 
Localizer-coupled,  crosswind 
and  turbulence 

Capt.  Dennis  Fitch,  UA  232  pilot, 
Ames  B-747-400  simulator 

Localizer 
Groundjtrack  capture 
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B-747  Control  with  Lateral  CG  Offset 
No  flight  controls,  both  left  engines  out 
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How  damage-tolerant  is  PCA? 
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Use  CG  shift,  gear  extension,  fuel  dump,  and  thrust  to  change  trim  speed 


PCA  Follow-On  Program 
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Pressure  transmitted  through  adjacent  bays  can  be 
significantly  reduced  through  decoupling 

Decoupling  allows  reflected  fluid  momentum  to  vent 
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Orbital  debris  (space  junk)  has  grown 
explosively  over  the  last  four  decades. 
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Orbital  Debris  is  highly  directional— approaching 
from  the  “front”  and  “sides”  of  a  stable  LEO  spacecraft. 
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Figure  3.  Patch  body  filled  with  adhesive  sealant.  ^  ‘Otefrial  cover  assembly  placed  over 

sprag  assembly  following  module 
re-pressurization  to  engure  seal 
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